CVE-2024-7035

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-7035
In version v0.3.8 of open-webui/open-webui, sensitive actions such as deleting and resetting are performed using the GET method. This vulnerability allows an attacker to perform Cross-Site Request Forgery (CSRF) attacks, where an unaware user can unintentionally perform sensitive actions by simply visiting a malicious site or through top-level navigation. The affected endpoints include /rag/api/v1/reset, /rag/api/v1/reset/db, /api/v1/memories/reset, and /rag/api/v1/reset/uploads. This impacts both the availability and integrity of the application.

6.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector : AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:L

Exploitability : 1.7 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact LOW

Scope CHANGED

References
Link Resource
https://huntr.com/bounties/2ac81740-410b-467a-9244-75d82a6f9e11 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:openwebui:open_webui:0.3.8:*:*:*:*:*:*:*
History

29 Jul 2025, 18:06

Type Values Removed Values Added
References () https://huntr.com/bounties/2ac81740-410b-467a-9244-75d82a6f9e11 - () https://huntr.com/bounties/2ac81740-410b-467a-9244-75d82a6f9e11 - Exploit, Third Party Advisory
Summary
  • (es) En la versión v0.3.8 de open-webui/open-webui, acciones sensibles como eliminar y restablecer se realizan mediante el método GET. Esta vulnerabilidad permite a un atacante realizar ataques de Cross-Site Request Forgery (CSRF), donde un usuario desprevenido puede realizar acciones sensibles sin querer simplemente visitando un sitio malicioso o a través de la navegación de nivel superior. Los endpoints afectados incluyen /rag/api/v1/reset, /rag/api/v1/reset/db, /api/v1/memories/reset y /rag/api/v1/reset/uploads. Esto afecta tanto la disponibilidad como la integridad de la aplicación.
First Time Openwebui open Webui
Openwebui
CPE cpe:2.3:a:openwebui:open_webui:0.3.8:*:*:*:*:*:*:*

20 Mar 2025, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-20 10:15

Updated : 2025-07-29 18:06

NVD link : CVE-2024-7035

Mitre link : CVE-2024-7035

CVE.ORG link : CVE-2024-7035

JSON object : View

Products Affected

openwebui

  • open_webui
CWE
CWE-352

Cross-Site Request Forgery (CSRF)