CVE-2024-30256

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-30256
Open WebUI is a user-friendly WebUI for LLMs. Open-webui is vulnerable to authenticated blind server-side request forgery. This vulnerability is fixed in 0.1.117.

6.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.1 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/open-webui/open-webui/security/advisories/GHSA-39wr-r5vm-3jxj Vendor Advisory
https://securitylab.github.com/advisories/GHSL-2024-033_open-webui Third Party Advisory Exploit
https://github.com/open-webui/open-webui/security/advisories/GHSA-39wr-r5vm-3jxj Vendor Advisory
https://securitylab.github.com/advisories/GHSL-2024-033_open-webui Third Party Advisory Exploit
Configurations

Configuration 1 (hide)

cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*
History

30 Jun 2025, 14:30

Type Values Removed Values Added
References () https://github.com/open-webui/open-webui/security/advisories/GHSA-39wr-r5vm-3jxj - () https://github.com/open-webui/open-webui/security/advisories/GHSA-39wr-r5vm-3jxj - Vendor Advisory
References () https://securitylab.github.com/advisories/GHSL-2024-033_open-webui - () https://securitylab.github.com/advisories/GHSL-2024-033_open-webui - Third Party Advisory, Exploit
First Time Openwebui
Openwebui open Webui
CPE cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*

21 Nov 2024, 09:11

Type Values Removed Values Added
References () https://github.com/open-webui/open-webui/security/advisories/GHSA-39wr-r5vm-3jxj - () https://github.com/open-webui/open-webui/security/advisories/GHSA-39wr-r5vm-3jxj -
References () https://securitylab.github.com/advisories/GHSL-2024-033_open-webui - () https://securitylab.github.com/advisories/GHSL-2024-033_open-webui -

19 Apr 2024, 17:15

Type Values Removed Values Added
References
  • () https://securitylab.github.com/advisories/GHSL-2024-033_open-webui -

17 Apr 2024, 12:48

Type Values Removed Values Added
Summary
  • (es) Open WebUI es una WebUI fácil de usar para LLM. Open-webui es vulnerable a blind server-side request forgery. Esta vulnerabilidad se solucionó en 0.1.117.

16 Apr 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-16 15:15

Updated : 2025-06-30 14:30

NVD link : CVE-2024-30256

Mitre link : CVE-2024-30256

CVE.ORG link : CVE-2024-30256

JSON object : View

Products Affected

openwebui

  • open_webui
CWE
CWE-918

Server-Side Request Forgery (SSRF)