CVE-2024-7035CWE-352

Cross-Site Request Forgery (CSRF) in open-webui/open-webui

Medium · published March 20, 2025

CVSS v3.0
6.9
EPSS
8%
Percentile
95.0
In the wild
Unconfirmed
What it is

In version v0.3.8 of open-webui/open-webui, sensitive actions such as deleting and resetting are performed using the GET method. This vulnerability allows an attacker to perform Cross-Site Request Forgery (CSRF) attacks, where an unaware user can unintentionally perform sensitive actions by simply visiting a malicious site or through top-level navigation. The affected endpoints include /rag/api/v1/reset, /rag/api/v1/reset/db, /api/v1/memories/reset, and /rag/api/v1/reset/uploads. This impacts both the availability and integrity of the application.

The record
Technical detail
CVSS v3.0
6.9 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.08459 · 95.0th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2025-03-20T10:10Z
EPSS history
Timeline
  • 20 MAR 10:10Z
    Cross-Site Request Forgery (CSRF) in open-webui/open-webui
    cvelistv5