CVE-2024-7806
CVSS 3.1 Score 8.8 of 10 (high)
Details
Published Mar 20, 2025
Updated: Mar 26, 2025
CWE ID 352
Summary
CVE-2024-7806 is a remote code execution vulnerability affecting open-webui versions prior to 0.3.9. This issue arises due to the use of lax SameSite cookies for authentication and the absence of CSRF tokens. An attacker can exploit this vulnerability by crafting a malicious HTML file and inducing a victim to access it. Once accessed, the attacker can successfully modify the Python code of an existing pipeline and execute arbitrary code utilizing the victim's privileges via Cross-Site Request Forgery (CSRF) attacks.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.