CVE-2024-8053

{"id": "CVE-2024-8053", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 3.9}]}, "published": "2025-03-20T10:15:39.993", "references": [{"url": "https://huntr.com/bounties/ebe8c1fa-113b-4df9-be03-a406b9adb9f4", "tags": ["Exploit", "Third Party Advisory"], "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/ebe8c1fa-113b-4df9-be03-a406b9adb9f4", "tags": ["Exploit", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-306"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "In version v0.3.10 of open-webui/open-webui, the `api/v1/utils/pdf` endpoint lacks authentication mechanisms, allowing unauthenticated attackers to access the PDF generation service. This vulnerability can be exploited by sending a POST request with an excessively large payload, potentially leading to server resource exhaustion and denial of service (DoS). Additionally, unauthorized users can misuse the endpoint to generate PDFs without verification, resulting in service misuse and potential operational and financial impacts."}, {"lang": "es", "value": "En la versi\u00f3n v0.3.10 de open-webui/open-webui, el endpoint `api/v1/utils/pdf` carece de mecanismos de autenticaci\u00f3n, lo que permite a atacantes no autenticados acceder al servicio de generaci\u00f3n de PDF. Esta vulnerabilidad puede explotarse enviando una solicitud POST con una carga excesiva, lo que podr\u00eda provocar el agotamiento de los recursos del servidor y una denegaci\u00f3n de servicio (DoS). Adem\u00e1s, usuarios no autorizados pueden usar indebidamente el endpoint para generar PDF sin verificaci\u00f3n, lo que resulta en un uso indebido del servicio y posibles impactos operativos y financieros."}], "lastModified": "2025-03-27T11:15:36.737", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openwebui:open_webui:0.3.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "29BD3977-F33C-4BD9-80A5-0D176D4176CE"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}