CVE-2024-8017

critical · 9

An XSS vulnerability exists in open-webui/open-webui versions <= 0.3.8, specifically in the function that constructs the HTML for tooltips. This vulnerability allows attackers to perform operations with the victim's privileges, such as stealing chat history, deleting chats, and escalating their own account to an admin if the victim is an admin.

CVSS

0.6%

EPSS (exploit prob.)

47th

EPSS percentile

2025-03-20

Published

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weaknesses

CWE-79

Affected products

Vendor	Product	Affected versions
openwebui	open_webui	<= 0.3.8

Check a specific version with /api/v1/cve/match.

References

https://huntr.com/bounties/ef06c7c8-1cb2-42a7-a6e6-17b2e1c744f7

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-8017