CVE-2024-11302— Missing check_access in lollms_binding_infos in parisneo/lollms
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-11302
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Missing check_access in lollms_binding_infos in parisneo/lollms
Source: NVD (National Vulnerability Database)
Vulnerability Description
A missing check_access() function in the lollms_binding_infos module of the parisneo/lollms repository, version V14, allows attackers to add, modify, and remove bindings arbitrarily. This vulnerability affects the /install_binding and /reinstall_binding endpoints, among others, enabling unauthorized access and manipulation of binding settings without requiring the client_id value.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
认证中关键步骤缺失
Source: NVD (National Vulnerability Database)
Vulnerability Title
LoLLMs 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
LoLLMs是Saifeddine ALOUI个人开发者的一个大型语言与多模态系统。 LoLLMs V14版本存在安全漏洞，该漏洞源于缺少check_access函数，导致攻击者可以随意添加、修改和删除绑定。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| parisneo | parisneo/lollms | unspecified ~ latest | - |
II. Public POCs for CVE-2024-11302
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-11302
请登录查看更多情报信息。
Same Patch Batch · parisneo · 2025-03-20 · 14 CVEs total
| CVE-2025-1451 | Insufficient Patch Leading to DoS in parisneo/lollms-webui | |
| CVE-2024-12766 | SSRF in parisneo/lollms-webui | |
| CVE-2024-6986 | Cross-site Scripting (XSS) in parisneo/lollms-webui | |
| CVE-2024-6982 | Remote Code Execution in Calculate Function in parisneo/lollms | |
| CVE-2024-7058 | Relative Path Traversal in parisneo/lollms-webui | |
| CVE-2024-8736 | Denial of Service (DoS) via Multipart Boundary in parisneo/lollms-webui | |
| CVE-2024-8581 | Path Traversal in parisneo/lollms-webui | |
| CVE-2024-8898 | Path Traversal in parisneo/lollms-webui | |
| CVE-2024-10019 | Path Traversal and OS Command Injection in parisneo/lollms-webui | |
| CVE-2024-10047 | Directory Listing Vulnerability in parisneo/lollms-webui | |
| CVE-2024-9597 | Path Traversal in parisneo/lollms | |
| CVE-2024-9920 | Unrestricted File Upload and Execution in parisneo/lollms-webui | |
| CVE-2024-9919 | Missing Authentication Check in parisneo/lollms-webui |
IV. Related Vulnerabilities
Same product: parisneo/lollms
Same vendor: parisneo
V. Comments for CVE-2024-11302
No comments yet