Home » Database

AVID-2026-R1583

Description

Missing client_id in parisneo/lollms-webui (CVE-2024-6040)

Details

In parisneo/lollms-webui version v9.8, the lollms_binding_infos is missing the client_id parameter, which leads to multiple security vulnerabilities. Specifically, the endpoints /reload_binding, /install_binding, /reinstall_binding, /unInstall_binding, /set_active_binding_settings, and /update_binding_settings are susceptible to CSRF attacks and local attacks. An attacker can exploit this vulnerability to perform unauthorized actions on the victim’s machine.

Reason for inclusion in AVID: The CVE describes a CSRF vulnerability in parisneo/lollms-webui (a web UI used to manage LLMs), affecting endpoints used in AI model deployment/management. This is a software component commonly used in AI pipelines, representing a potential security risk in the AI software stack. Therefore, it fits as a software supply chain vulnerability in general-purpose AI systems.

References

Affected or Relevant Artifacts

  • Developer: parisneo
  • Deployer: parisneo
  • Artifact Details:
TypeName
Systemparisneo/lollms

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.0
Vector StringCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Base Score4.4
Base Severity🟠 Medium
Attack VectorLOCAL
Attack Complexity🟢 Low
Privileges RequiredNONE
User InteractionREQUIRED
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity Impact🟢 Low
Availability Impact🟢 Low

CWE

IDDescription
CWE-352CWE-352 Cross-Site Request Forgery (CSRF)

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2024-08-01
  • Version: 0.3.3
  • AVID Entry