CyberRota Analysis
AI-GeneratedThe vulnerability arises from a cross-origin resource sharing misconfiguration in open-webui versions prior to 0.3.14, which permits arbitrary origins due to the use of allow_origins=*. This flaw allows attackers to execute arbitrary code on the affected instance by sending malicious cross-site requests when an admin user accesses compromised websites. Organizations using open-webui should prioritize remediation to protect against potential exploitation and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow_origins=* and authenticated requests to the /api/v1/functions endpoint. Attackers can execute arbitrary code on the openwebui instance by crafting malicious cross-site requests from attacker-controlled websites when an admin user visits them.
Related CVEs
Other vulnerabilities affecting the same vendor(s)