CVE-2024-9919

{"id": "CVE-2024-9919", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.5}]}, "published": "2025-03-20T10:15:50.660", "references": [{"url": "https://huntr.com/bounties/5c00f56b-32a8-4e26-a4e3-de64f139da6b", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "security@huntr.dev"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "A missing authentication check in the uninstall endpoint of parisneo/lollms-webui V13 allows attackers to perform unauthorized directory deletions. The /uninstall/{app_name} API endpoint does not call the check_access() function to verify the client_id, enabling attackers to delete directories without proper authentication."}, {"lang": "es", "value": "Una comprobaci\u00f3n de autenticaci\u00f3n faltante en el endpoint de desinstalaci\u00f3n de parisneo/lollms-webui V13 permite a los atacantes eliminar directorios sin autorizaci\u00f3n. El endpoint de la API /uninstall/{app_name} no llama a la funci\u00f3n check_access() para verificar el client_id, lo que permite a los atacantes eliminar directorios sin la autenticaci\u00f3n adecuada."}], "lastModified": "2025-10-15T13:15:59.840", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lollms:lollms_web_ui:13:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "33B0BD9C-2312-401C-9E7F-C3E614A336A3"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}