CVE-2024-5824

Description

A path traversal vulnerability in the /set_personality_config endpoint of parisneo/lollms version 9.4.0 allows an attacker to overwrite the configs/config.yaml file. This can lead to remote code execution by changing server configuration properties such as force_accept_remote_access and turn_on_code_validation.

Risk Information

Base Score

7.4

MODERATE

Vector

CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

1.395

Associated Vulnerability

Vulnerability	OS Platform
Multiple vulnerabilities are fixed in Python-lollms 9.5.0	Windows
Multiple vulnerabilities are fixed in Python-lollms for linux 9.5.0	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234