CVE-2024-7048
CVSS 3.0 Score 6.3 of 10 (medium)
Details
Published Oct 10, 2024
CWE ID 269
Summary
CVE-2024-7048 is a newly identified privilege management vulnerability affecting version 0.3.8 of open-webui. This issue is found in the API endpoints GET /api/v1/documents/ and POST /rag/api/v1/doc. A lower-privileged user can exploit this vulnerability to gain unauthorized access to and overwrite files managed by a higher-privileged admin. As a result, attackers can view sensitive metadata of files uploaded by administrators and manipulate them, compromising both the integrity and availability of the RAG models.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.