« Volver al listado

CVE-2024-6706

Estado: ModificadaMedia (6.1)—

Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Openwebui — Open Webui

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-6706",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-6706",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-08T13:12:33.075223Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "bbf0bd87-ece2-41be-b873-96928ee8fab9",
      "affectedData": [
        {
          "repo": "https://github.com/open-webui/open-webui",
          "vendor": "Open WebUI",
          "product": "Open WebUI",
          "versions": [
            {
              "status": "affected",
              "version": "0.1.105"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:openwebui:open_webui:0.1.105:*:*:*:*:*:*:*"
          ],
          "vendor": "openwebui",
          "product": "open_webui",
          "versions": [
            {
              "status": "affected",
              "version": "0.1.105"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-08-07T23:15:41.350",
  "references": [
    {
      "url": "https://korelogic.com/Resources/Advisories/KL-001-2024-005.txt",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "bbf0bd87-ece2-41be-b873-96928ee8fab9"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2024/Aug/3",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2024/08/08/6",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "bbf0bd87-ece2-41be-b873-96928ee8fab9",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page."
    },
    {
      "lang": "es",
      "value": "Los atacantes pueden crear un mensaje malicioso que obligue al modelo de lenguaje a ejecutar JavaScript arbitrario en el contexto de la página web."
    }
  ],
  "lastModified": "2026-06-17T08:18:31.187",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openwebui:open_webui:0.1.105:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "33127669-DDB0-4B45-9D9D-D3B85CEC7180"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "46D69DCC-AE4D-4EA5-861C-D60951444C6C"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "bbf0bd87-ece2-41be-b873-96928ee8fab9"
}