CVE-2024-47066

Lobehub Lobe Chat vulnerability

9.0 CRITICALEPSS 11.8%

Published23 Sept 2024

Description

Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forgery protection implemented in `src/app/api/proxy/route.ts` does not consider redirect and could be bypassed when attacker provides an external malicious URL which redirects to internal resources like a private network or loopback address. Version 1.19.13 contains an improved fix for the issue.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredHigh

User interactionNone

ScopeChanged

ConfidentialityHigh

IntegrityLow

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H

Affected products

Lobehub Lobe Chat< 1.19.3

Remediation

Fixed in

Lobehub Lobe Chat≥ 1.19.3

Frequently asked

Is CVE-2024-47066 being actively exploited?

CVE-2024-47066 is not in the CISA KEV catalog. Its EPSS exploit probability is 11.8%.

How severe is CVE-2024-47066?

CVE-2024-47066 has a CVSS 3.1 base score of 9.0, rated critical. EPSS estimates a 11.8% probability of exploitation.

Which products are affected by CVE-2024-47066?

Affected products include Lobehub Lobe Chat.

How do I fix CVE-2024-47066?

Upgrade affected software to a fixed version, for example Lobehub Lobe Chat 1.19.3 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2024-47066 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.