VYPR
← All advisories
High severity7.1NVD Advisory· Published Oct 29, 2024· Updated Jun 17, 2026

CVE-2024-6674

CVE-2024-6674

Description

A CORS misconfiguration in parisneo/lollms-webui prior to version 10 allows attackers to steal sensitive information such as logs, browser sessions, and settings containing private API keys from other services. This vulnerability can also enable attackers to perform actions on behalf of a user, such as deleting a project or sending a message. The issue impacts the confidentiality and integrity of the information.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Lollms/Lollms3 versions
    cpe:2.3:a:lollms:lollms_web_ui:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:lollms:lollms_web_ui:*:*:*:*:*:*:*:*range: <10
    • (no CPE)range: <10
    • (no CPE)range: unspecified

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.