← CVE Intelligence

CVE-2024-4328

CSRF in clear_personality_files_list in parisneo/lollms-webui PUBLISHED

Description (CNA)

A Cross-Site Request Forgery (CSRF) vulnerability exists in the clear_personality_files_list function of the parisneo/lollms-webui v9.6. The vulnerability arises from the use of a GET request to clear personality files list, which lacks proper CSRF protection. This flaw allows attackers to trick users into performing actions without their consent, such as deleting important files on the system. The issue is present in the application's handling of requests, making it susceptible to CSRF attacks that could lead to unauthorized actions being performed on behalf of the user.

Affected (CNA)

Vendor / productVersions
parisneo / parisneo/lollms-webuiaffected unspecified through latest

CWE

CWE-352

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.