CVE-2024-5616 MEDIUM

CVE-2024-5616: CSRF Vulnerability in mudler/LocalAI

Vendor Mudler
Product mudler/localai
Weakness CWE-352 · CSRF
Published July 6, 2024
Last update August 1, 2024
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity None

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

What the vulnerability does

01Description

A Cross-Site Request Forgery (CSRF) vulnerability exists in mudler/LocalAI versions up to and including 2.15.0, which allows attackers to trick victims into deleting installed models. By crafting a malicious HTML page, an attacker can cause the deletion of a model, such as 'gpt-4-vision-preview', without the victim's consent. The vulnerability is due to insufficient CSRF protection mechanisms on the model deletion functionality.

Key dates

02Disclosure timeline

July 6, 2024 CVE published
August 1, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-32450 WordPress WpTravelly plugin <= 1.6.0 - Cross Site Request Forgery (CSRF) vulnerability CVE-2025-39416 WordPress translit it! plugin <= 1.6 - CSRF to Stored XSS vulnerability CVE-2025-26569 WordPress Post Thumbs Plugin <= 1.5 - CSRF to Stored XSS vulnerability CVE-2023-39158 WordPress Woocommerce Category Banner Management Plugin <= 2.4.2 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2025-49856 WordPress Responsive Plus plugin <= 3.2.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability