CVE-2024-1873

{"id": "CVE-2024-1873", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 3.9}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2024-06-06T19:15:51.460", "references": [{"url": "https://huntr.com/bounties/c1cfc0d9-517a-4d0e-bf1c-6444c1fd195d", "tags": ["Third Party Advisory"], "source": "security@huntr.dev"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}, {"type": "Secondary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-749"}]}], "descriptions": [{"lang": "en", "value": "parisneo/lollms-webui is vulnerable to path traversal and denial of service attacks due to an exposed `/select_database` endpoint in version a9d16b0. The endpoint improperly handles file paths, allowing attackers to specify absolute paths when interacting with the `DiscussionsDB` instance. This flaw enables attackers to create directories anywhere on the system where the application has permissions, potentially leading to denial of service by creating directories with names of critical files, such as HTTPS certificate files, causing server startup failures. Additionally, attackers can manipulate the database path, resulting in the loss of client data by constantly changing the file location to an attacker-controlled location, scattering the data across the filesystem and making recovery difficult."}, {"lang": "es", "value": "parisneo/lollms-webui es vulnerable a ataques de path traversal y denegaci\u00f3n de servicio debido a un endpoint `/select_database` expuesto en la versi\u00f3n a9d16b0. El endpoint maneja incorrectamente las rutas de los archivos, lo que permite a los atacantes especificar rutas absolutas al interactuar con la instancia `DiscussionsDB`. Esta falla permite a los atacantes crear directorios en cualquier parte del sistema donde la aplicaci\u00f3n tenga permisos, lo que podr\u00eda provocar una denegaci\u00f3n de servicio al crear directorios con nombres de archivos cr\u00edticos, como archivos de certificados HTTPS, lo que provoca fallas en el inicio del servidor. Adem\u00e1s, los atacantes pueden manipular la ruta de la base de datos, lo que resulta en la p\u00e9rdida de datos del cliente al cambiar constantemente la ubicaci\u00f3n del archivo a una ubicaci\u00f3n controlada por el atacante, dispersando los datos por todo el sistema de archivos y dificultando la recuperaci\u00f3n."}], "lastModified": "2024-10-15T19:14:09.547", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lollms:lollms_web_ui:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E0447480-50CE-4682-B3B1-B8F021C5C731"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}