by Kastro
Paper/Archive/CVE-2024-8017

CVE-2024-8017

open-webui open-webui/open-webui — Cross-site Scripting (XSS) in open-webui/open-webui

EPSS 0.6%public exploitCVSS 9.0
critical.is priorityof 100
47
CVSS 9.0 (CNA)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 49.4.494 × 209.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

An XSS vulnerability exists in open-webui/open-webui versions <= 0.3.8, specifically in the function that constructs the HTML for tooltips. This vulnerability allows attackers to perform operations with the victim's privileges, such as stealing chat history, deleting chats, and escalating their own account to an admin if the victim is an admin.

Affected

ProductAffectedFixed inSource
open-webui/open-webuiunspecified – latest–CNA

Scores by source

@huntr_ai (CNA)9.0CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refhuntr.com/bounties/ef06c7c8-1cb2-42a7-a6e6-17b2e1c744f7