CVE-2024-6673
EUVD-2024-4772429.10.2024, 13:15
A Cross-Site Request Forgery (CSRF) vulnerability exists in the `install_comfyui` endpoint of the `lollms_comfyui.py` file in the parisneo/lollms-webui repository, versions v9.9 to the latest. The endpoint uses the GET method without requiring a client ID, allowing an attacker to trick a victim into installing ComfyUI. If the victim's device does not have sufficient capacity, this can result in a crash.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| lollms | lollms_web_ui | 𝑥 < 10 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| parisneo | lollms-webui | 𝑥 < 9.9 | ADP |
Common Weakness Enumeration