GHSA-9p73-x86v-jw57

Source

https://github.com/advisories/GHSA-9p73-x86v-jw57

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-9p73-x86v-jw57/GHSA-9p73-x86v-jw57.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-9p73-x86v-jw57

Aliases

CVE-2024-4330

Published

2024-06-02T22:30:25Z

Modified

2024-06-02T22:57:04.753041Z

Severity

4.0 (Medium) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

path traversal vulnerability was identified in the parisneo/lollms-webui

Details

A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to improper handling of user-supplied input in the 'listpersonalities' endpoint. By crafting a malicious HTTP request, an attacker can traverse the directory structure and view the contents of any folder, albeit limited to subfolder names only. This issue was demonstrated via a specific HTTP request that manipulated the 'category' parameter to access arbitrary directories. The vulnerability is present in the code located at the 'endpoints/lollmsadvanced.py' file.

Database specific

{
    "nvd_published_at": "2024-05-30T15:15:49Z",
    "cwe_ids": [
        "CWE-23"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-06-02T22:30:25Z"
}

GHSA-9p73-x86v-jw57

Affected packages

PyPI / lollms

Package

Affected ranges

Affected versions

9.*