CVE-2024-12537— Unauthenticated Denial of Service in open-webui/open-webui
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-12537
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unauthenticated Denial of Service in open-webui/open-webui
Source: NVD (National Vulnerability Database)
Vulnerability Description
In version 0.3.32 of open-webui/open-webui, the absence of authentication mechanisms allows any unauthenticated attacker to access the `api/v1/utils/code/format` endpoint. If a malicious actor sends a POST request with an excessively high volume of content, the server could become completely unresponsive. This could lead to severe performance issues, causing the server to become unresponsive or experience significant degradation, ultimately resulting in service interruptions for legitimate users.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
不加限制或调节的资源分配
Source: NVD (National Vulnerability Database)
Vulnerability Title
Open WebUI 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Open WebUI是Open WebUI开源的一个可扩展、功能丰富、用户友好的自托管 WebUI。 Open WebUI 0.3.32版本存在安全漏洞，该漏洞源于未验证身份验证机制，可能导致拒绝服务攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| open-webui | open-webui/open-webui | unspecified ~ latest | - |
II. Public POCs for CVE-2024-12537
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-12537
请登录查看更多情报信息。
Same Patch Batch · open-webui · 2025-03-20 · 20 CVEs total
| CVE-2024-7046 | Improper Access Control in open-webui/open-webui | |
| CVE-2024-8053 | Improper Authentication in open-webui/open-webui | |
| CVE-2024-8017 | Cross-site Scripting (XSS) in open-webui/open-webui | |
| CVE-2024-8060 | Remote Code Execution in OpenWebUI via Arbitrary File Upload | |
| CVE-2024-7990 | Stored Cross-Site Scripting in open-webui/open-webui | |
| CVE-2024-7043 | Improper Access Control in open-webui/open-webui | |
| CVE-2024-7983 | Denial of Service in open-webui/open-webui | |
| CVE-2024-7035 | Cross-Site Request Forgery (CSRF) in open-webui/open-webui | |
| CVE-2024-7053 | Session Fixation in open-webui/open-webui | |
| CVE-2024-7806 | Remote Code Execution by Non-Admin Users via CSRF in open-webui/open-webui | |
| CVE-2024-12534 | Denial of Service (DoS) in open-webui/open-webui | |
| CVE-2024-7033 | Arbitrary File Write in open-webui/open-webui | |
| CVE-2024-7036 | Denial of Service in open-webui/open-webui | |
| CVE-2024-7044 | Stored XSS in open-webui/open-webui | |
| CVE-2024-7040 | Improper Access Control in open-webui/open-webui | |
| CVE-2024-7045 | Improper Access Control in open-webui/open-webui | |
| CVE-2024-7959 | SSRF in open-webui/open-webui | |
| CVE-2024-7034 | Remote Code Execution due to Arbitrary File Write in open-webui/open-webui | |
| CVE-2024-7039 | Improper Privilege Management in open-webui/open-webui |
IV. Related Vulnerabilities
Same product: open-webui/open-webui
- CVE-2024-8017
Cross-site Scripting (XSS) in open-webui/open-webui - CVE-2024-7053
Session Fixation in open-webui/open-webui - CVE-2024-8053
Improper Authentication in open-webui/open-webui - CVE-2024-7806
Remote Code Execution by Non-Admin Users via CSRF in open-we - CVE-2024-7039
Improper Privilege Management in open-webui/open-webui
Same vendor: open-webui
- CVE-2026-45338
Open WebUI: SSRF via OAuth Profile Picture URL in _process_p - CVE-2026-44549
Open WebUI: Stored XSS in excel file preview - CVE-2026-45299
Open WebUI: Stored Cross-Site Scripting In Profile Picture - CVE-2026-45665
Open WebUI: Stored XSS in Banner Component via Improper Sani - CVE-2026-45667
Open WebUI: Unauthenticated endpoint can trigger embedding g
Same weakness: CWE-770
- CVE-2021-47959
WordPress Plugin WPGraphQL 1.3.5 Denial of Service - CVE-2026-44679
Tuist: Forgot password flow lacks throttling for reset email - CVE-2026-44216
Wasmtime: Panic when allocating a table exceeding the size o - CVE-2026-8468
Unbounded buffer accumulation in multipart header parsing ca - CVE-2025-14870
Allocation of Resources Without Limits or Throttling in GitL
V. Comments for CVE-2024-12537
No comments yet