Vulnerability · Published Apr 16, 2024 · Assigned by @huntr_ai

CVE-2024-1569Uncontrolled Resource Consumption in parisneo/lollms-webui

Medium 5.3

In plain English

A medium-severity uncontrolled resource consumption in parisneo/lollms-webui from parisneo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).

Severity (CVSS 3.0)5.3Medium

Exploit odds (30 days)0.8%top 43.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

parisneo/lollms-webui is vulnerable to a denial of service (DoS) attack due to uncontrolled resource consumption. Attackers can exploit the `/open_code_in_vs_code` and similar endpoints without authentication by sending repeated HTTP POST requests, leading to the opening of Visual Studio Code or the default folder opener (e.g., File Explorer, xdg-open) multiple times. This can render the host machine unusable by exhausting system resources. The vulnerability is present in the latest version of the software.

Affected products (as reported)

Vendor	Product	Versions
parisneo	parisneo/lollms-webui	unspecified – before 9.2

Weakness: CWE-400 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

In plain English

Official description

Affected products (as reported)

References