Open WebUI Uncontrolled Resource Consumption vulnerability

Description

In version v0.3.32 of open-webui/open-webui, the application allows users to submit large payloads in the email and password fields during the sign-in process due to the lack of character length validation on these inputs.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.3.32

References

• GHSA-g3mx-83mp-3rwc
• huntr.com
• CVE-2024-12534
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Open WebUI Uncontrolled Resource Consumption vulnerability - open-webui - CVE-2024-12537
• graphql Uncontrolled Resource Consumption vulnerability - CVE-2023-26144
• Uncontrolled resource consumption in braces - CVE-2024-4068
• Uncontrolled Resource Consumption in trim-off-newlines - CVE-2021-23425

You might also like:

Exploiting Server Version Disclosure

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

open-webui