CVE-2024-6040: 120 is being updated in the LTC (Long Term Support Candidate) channel, version 1200.6099.301 (Platform Version: 15662.96.0), for most ChromeOS devices.
In parisneo/lollms-webui version v9.8, the lollmsbindinginfos is missing the clientid parameter, which leads to multiple security vulnerabilities. Specifically, the endpoints /reloadbinding, /installbinding, /reinstallbinding, /unInstallbinding, /setactivebindingsettings, and /updatebindingsettings are susceptible to CSRF attacks and local attacks. An attacker can exploit this vulnerability to perform unauthorized actions on the victim's machine.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6040?
CVE-2024-6040 is considered to have multiple security vulnerabilities due to the missing client_id parameter.
How do I fix CVE-2024-6040?
To fix CVE-2024-6040, ensure that the client_id parameter is included in the lollms_binding_infos configuration.
Which software is affected by CVE-2024-6040?
CVE-2024-6040 affects the pariso lollms-webui version v9.8 and Google ChromeOS.
What endpoints are vulnerable in CVE-2024-6040?
The vulnerable endpoints in CVE-2024-6040 include /reload_binding, /install_binding, /reinstall_binding, /unInstall_binding, and /set_active_binding_settings.
What are the potential impacts of CVE-2024-6040?
The lack of the client_id parameter in CVE-2024-6040 may lead to unauthorized access and other security issues.