Vulnerability · Published Jul 6, 2024 · Assigned by @huntr_ai

CVE-2024-5616CSRF Vulnerability in mudler/LocalAI

Medium 4.3

In plain English

A medium-severity cross-site request forgery in mudler/localai from mudler. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.0)4.3Medium

Exploit odds (30 days)0.3%top 82.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A Cross-Site Request Forgery (CSRF) vulnerability exists in mudler/LocalAI versions up to and including 2.15.0, which allows attackers to trick victims into deleting installed models. By crafting a malicious HTML page, an attacker can cause the deletion of a model, such as 'gpt-4-vision-preview', without the victim's consent. The vulnerability is due to insufficient CSRF protection mechanisms on the model deletion functionality.

Affected products (as reported)

Vendor	Product	Versions
mudler	mudler/localai	unspecified – before 2.17

Weakness: CWE-352 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

In plain English

Official description

Affected products (as reported)

References