{"data":{"id":"220883b7-1d0a-4167-9611-3ea87fd4613d","title":"CVE-2024-4839: A Cross-Site Request Forgery (CSRF) vulnerability exists in the 'Servers Configurations' function of the…","summary":"A Cross-Site Request Forgery (CSRF) vulnerability in the 'Servers Configurations' function of parisneo/lollms-webui, versions 9.6 to the latest, affects the Elastic search Service (under construction), XTTS service, Petals service, vLLM service, and Motion Ctrl service, which lack CSRF protection. An attacker can submit a malicious installation request that tricks users into unwittingly installing the XTTS service among other packages, performing actions without their consent.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-4839","publishedAt":"2024-06-24T17:15:11.900Z","cveId":"CVE-2024-4839","cweIds":["CWE-352"],"cvssScore":"3.3","cvssSeverity":"low","severity":"low","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["lollms-webui","XTTS","Petals","vLLM","Elastic search"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"lollms-webui CSRF in Servers Configurations service installation","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00163,"epssCheckedAt":"2026-11-04T00:12:27.299Z","kevDateAdded":null,"advisoryAliases":["GHSA-v2f9-5493-gg7h"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-29T06:09:40.588Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}