CVE-2024-12537

In version 0.3.32 of open-webui/open-webui, the absence of authentication mechanisms allows any unauthenticated attacker to access the `api/v1/utils/code/format` endpoint. If a malicious actor sends a POST request with an excessively high volume of content, the server could become completely unresponsive. This could lead to severe performance issues, causing the server to become unresponsive or experience significant degradation, ultimately resulting in service interruptions for legitimate users.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://huntr.com/bounties/edabd06c-acc0-428c-a481-271f333755bc	Exploit
https://huntr.com/bounties/edabd06c-acc0-428c-a481-271f333755bc	Exploit

Configurations

Configuration 1 (hide)

cpe:2.3:a:openwebui:open_webui:0.3.32:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-03-20 10:15

Updated : 2025-04-04 09:15

NVD link : CVE-2024-12537

Mitre link : CVE-2024-12537

CVE.ORG link : CVE-2024-12537

JSON object : View

Products Affected

openwebui

open_webui

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2024-12537", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2025-03-20T10:15:29.140", "references": [{"url": "https://huntr.com/bounties/edabd06c-acc0-428c-a481-271f333755bc", "tags": ["Exploit"], "source": "[email protected]"}, {"url": "https://huntr.com/bounties/edabd06c-acc0-428c-a481-271f333755bc", "tags": ["Exploit"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-770"}]}, {"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "In version 0.3.32 of open-webui/open-webui, the absence of authentication mechanisms allows any unauthenticated attacker to access the `api/v1/utils/code/format` endpoint. If a malicious actor sends a POST request with an excessively high volume of content, the server could become completely unresponsive. This could lead to severe performance issues, causing the server to become unresponsive or experience significant degradation, ultimately resulting in service interruptions for legitimate users."}, {"lang": "es", "value": "En la versi\u00f3n 0.3.32 de open-webui/open-webui, la ausencia de mecanismos de autenticaci\u00f3n permite a cualquier atacante no autenticado acceder al endpoint `api/v1/utils/code/format`. Si un atacante env\u00eda una solicitud POST con un volumen excesivo de contenido, el servidor podr\u00eda dejar de responder por completo. Esto podr\u00eda provocar graves problemas de rendimiento, provocando que el servidor deje de responder o experimente una degradaci\u00f3n significativa, lo que a su vez provocar\u00eda interrupciones del servicio para los usuarios leg\u00edtimos."}], "lastModified": "2025-04-04T09:15:15.947", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openwebui:open_webui:0.3.32:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9D070B86-0839-459E-9C0F-D8F945F82337"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}