This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2024-7053
Published Mar 20, 2025
CVSS n/a
EPSS n/a
KEV · Not listed
Description
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Analysis
Affected Products
-
CVE record
No data
-
NVD configurations
No data
-
Red Hat packages
No data
-
OpenCVE enrichment
No data
No data.
No data.
No data.
No data available yet.
Remediation
Tracking
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2025-6956 | A vulnerability in open-webui/open-webui version 0.3.8 allows an attacker with a user-level account to perform a session fixation attack. The session cookie for all users is set with the default `SameSite=Lax` and does not have the `Secure` flag enabled, allowing the session cookie to be sent over HTTP to a cross-origin domain. An attacker can exploit this by embedding a malicious markdown image in a chat, which, when viewed by an administrator, sends the admin's session cookie to the attacker's server. This can lead to a stealthy administrator account takeover, potentially resulting in remote code execution (RCE) due to the elevated privileges of administrator accounts. |
 Github GHSA |
GHSA-43g4-487m-5q6m | Open WebUI Vulnerable to a Session Fixation Attack |
Metrics
No CVSS v4.0
No CVSS v3.1
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
No EPSS score available.
Key SSVC decision points have not yet been added.
References
No reference.
History
Aug 13, 2026 4:30 PM
Title updated. References updated. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Session Fixation in open-webui/open-webui | |
| References |
|
|
| Metrics |
ssvc
|
Aug 13, 2026 3:30 PM
Weaknesses updated. Affected versions updated. Affected vendors updated. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-79 | |
| CPEs | ||
| Vendors & Products |
Openwebui
Openwebui open Webui |
|
| Metrics |
cvssV3_0
|
Aug 13, 2026 3:15 PM
Description updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A vulnerability in open-webui/open-webui version 0.3.8 allows an attacker with a user-level account to perform a session fixation attack. The session cookie for all users is set with the default `SameSite=Lax` and does not have the `Secure` flag enabled, allowing the session cookie to be sent over HTTP to a cross-origin domain. An attacker can exploit this by embedding a malicious markdown image in a chat, which, when viewed by an administrator, sends the admin's session cookie to the attacker's server. This can lead to a stealthy administrator account takeover, potentially resulting in remote code execution (RCE) due to the elevated privileges of administrator accounts. | This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
Apr 1, 2025 9:00 PM
First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Openwebui
Openwebui open Webui |
|
| CPEs | cpe:2.3:a:openwebui:open_webui:0.3.8:*:*:*:*:*:*:* | |
| Vendors & Products |
Openwebui
Openwebui open Webui |
|
| Metrics |
cvssV3_1
|
Mar 20, 2025 2:15 PM
Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Mar 20, 2025 10:15 AM
Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A vulnerability in open-webui/open-webui version 0.3.8 allows an attacker with a user-level account to perform a session fixation attack. The session cookie for all users is set with the default `SameSite=Lax` and does not have the `Secure` flag enabled, allowing the session cookie to be sent over HTTP to a cross-origin domain. An attacker can exploit this by embedding a malicious markdown image in a chat, which, when viewed by an administrator, sends the admin's session cookie to the attacker's server. This can lead to a stealthy administrator account takeover, potentially resulting in remote code execution (RCE) due to the elevated privileges of administrator accounts. | |
| Title | Session Fixation in open-webui/open-webui | |
| Weaknesses | CWE-79 | |
| References |
| |
| Metrics |
cvssV3_0
|
Subscriptions
No data.
Weaknesses
No weakness.
