// For flags

CVE-2024-24566

Lobe Chat unauthorized access to plugins

Severity Score

5.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. When the application is password-protected (deployed with the `ACCESS_CODE` option), it is possible to access plugins without proper authorization (without password). This vulnerability is patched in 0.122.4.

Lobe Chat es un framework de chatbot que admite síntesis de voz, sistema de complemento de llamada de función multimodal y extensible. Cuando la aplicación está protegida con contraseña (implementada con la opción `ACCESS_CODE`), es posible acceder a los complementos sin la autorización adecuada (sin contraseña). Esta vulnerabilidad está parcheada en 0.122.4.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2024-01-25 CVE Reserved
  • 2024-01-31 CVE Published
  • 2024-02-10 EPSS Updated
  • 2024-08-01 CVE Updated
  • 2024-08-01 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-284: Improper Access Control
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Lobehub
Search vendor "Lobehub"
 Lobe Chat
Search vendor "Lobehub" for product "Lobe Chat"
 < 0.122.4
Search vendor "Lobehub" for product "Lobe Chat" and version " < 0.122.4"
-
Affected