CVE-2024-1569CWE-400

Uncontrolled Resource Consumption in parisneo/lollms-webui

Medium · published April 16, 2024

CVSS v3.0
5.3
EPSS
1%
Percentile
55.5
In the wild
Unconfirmed
What it is

parisneo/lollms-webui is vulnerable to a denial of service (DoS) attack due to uncontrolled resource consumption. Attackers can exploit the `/open_code_in_vs_code` and similar endpoints without authentication by sending repeated HTTP POST requests, leading to the opening of Visual Studio Code or the default folder opener (e.g., File Explorer, xdg-open) multiple times. This can render the host machine unusable by exhausting system resources. The vulnerability is present in the latest version of the software.

The record
Technical detail
CVSS v3.0
5.3 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00782 · 55.5th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2024-04-16T00:00Z
EPSS history
Timeline
  • 16 APR 00:00Z
    Uncontrolled Resource Consumption in parisneo/lollms-webui
    cvelistv5