AVID-2026-R1583
Description
Missing client_id in parisneo/lollms-webui (CVE-2024-6040)
Details
In parisneo/lollms-webui version v9.8, the lollms_binding_infos is missing the client_id parameter, which leads to multiple security vulnerabilities. Specifically, the endpoints /reload_binding, /install_binding, /reinstall_binding, /unInstall_binding, /set_active_binding_settings, and /update_binding_settings are susceptible to CSRF attacks and local attacks. An attacker can exploit this vulnerability to perform unauthorized actions on the victim’s machine.
Reason for inclusion in AVID: The CVE describes a CSRF vulnerability in parisneo/lollms-webui (a web UI used to manage LLMs), affecting endpoints used in AI model deployment/management. This is a software component commonly used in AI pipelines, representing a potential security risk in the AI software stack. Therefore, it fits as a software supply chain vulnerability in general-purpose AI systems.
References
Affected or Relevant Artifacts
- Developer: parisneo
- Deployer: parisneo
- Artifact Details:
| Type | Name |
|---|---|
| System | parisneo/lollms |
Impact
AVID Taxonomy Categorization
- Risk domains: Security
- SEP subcategories: S0100: Software Vulnerability
- Lifecycle stages: L06: Deployment
CVSS
| Version | 3.0 |
| Vector String | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L |
| Base Score | 4.4 |
| Base Severity | 🟠 Medium |
| Attack Vector | LOCAL |
| Attack Complexity | 🟢 Low |
| Privileges Required | NONE |
| User Interaction | REQUIRED |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | 🟢 Low |
| Availability Impact | 🟢 Low |
CWE
| ID | Description |
|---|---|
| CWE-352 | CWE-352 Cross-Site Request Forgery (CSRF) |
Other information
- Report Type: Advisory
- Credits:
- Date Reported: 2024-08-01
- Version: 0.3.3
- AVID Entry