ByteOS Network

NVD Vulnerability Details :

CVE-2024-8017

Analyzed

Source-security@huntr.dev

Published At-20 Mar, 2025 | 10:15

Updated At-21 Jul, 2025 | 20:08

An XSS vulnerability exists in open-webui/open-webui versions <= 0.3.8, specifically in the function that constructs the HTML for tooltips. This vulnerability allows attackers to perform operations with the victim's privileges, such as stealing chat history, deleting chats, and escalating their own account to an admin if the victim is an admin.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.0	9.0	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Type: Secondary

Version: 3.0

Base score: 9.0

Base severity: CRITICAL

Vector:

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

CPE Matches

openwebui>>open_webui>>Versions up to 0.3.8(inclusive)

cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	security@huntr.dev

CWE ID: CWE-79

Type: Primary

Source: security@huntr.dev

References

Hyperlink	Source	Resource
https://huntr.com/bounties/ef06c7c8-1cb2-42a7-a6e6-17b2e1c744f7	security@huntr.dev	Exploit Third Party Advisory

Hyperlink: https://huntr.com/bounties/ef06c7c8-1cb2-42a7-a6e6-17b2e1c744f7

Source: security@huntr.dev

Resource:

Exploit

Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History