CVE-2024-7038
CVSS 3.1 Score 2.7 of 10 (low)
Details
Published Oct 9, 2024
Updated: Nov 3, 2024
CWE ID 209
Summary
CVE-2024-7038 is an information disclosure vulnerability affecting open-webui version 0.3.8. The issue lies in the model update feature under admin settings. When a user attempts to update the model path, the system checks for the file's existence and provides varying error messages based on the file's presence and configuration. An attacker can exploit this behavior to enumerate file names and traverse directories by analyzing the error messages, potentially exposing sensitive information.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.