CVE-2024-7049

Medium

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

@huntr_ai·CWE-488·Published 2024-10-10

CVSS

5.4

EPSS

0.00

KEV

Exploits

cve.orgen

242 chars

In version v0.3.8 of open-webui/open-webui, a vulnerability exists where a token is returned when a user with a pending role logs in. This allows the user to perform actions without admin confirmation, bypassing the intended approval process.

NVDen

91 chars

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

NVDes

283 chars

En la versión v0.3.8 de open-webui/open-webui, existe una vulnerabilidad en la que se devuelve un token cuando un usuario con un rol pendiente inicia sesión. Esto permite al usuario realizar acciones sin la confirmación del administrador, omitiendo el proceso de aprobación previsto.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
3.0	Primary	cve.org	5.4	—	—	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
3.0	Primary	cve.org	5.4	—	—	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N