Open WebUI Vulnerable to Cross-Site Scripting (XSS) via Chat File Upload
A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui version 0.3.8. An attacker can inject malicious content into a file, which, when accessed by a victim through a URL or shared chat, executes JavaScript in the victim's browser. This can lead to user data theft, session hijacking, malware distribution, and phishing attacks.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-7044US | high8.9 | — | ||
A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui version 0.3.8. An attacker can inject malicious content into… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/advisories/GHSA-j274-m559-cj4jADVISORY
- https://github.com/open-webui/open-webuiPACKAGE
- https://github.com/open-webui/open-webui/commit/0da0e12096cc771ce4359c163e03c5a754d95c5eFIX
- https://huntr.com/bounties/c25a885c-d6e2-4169-9ee8-4d33bcbb5ef6WEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-7044ADVISORY
- https://pypi.org/project/open-webuiPACKAGE
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan