CVE-2024-7983 Details
Description
In version 0.3.8 of open-webui, an endpoint for converting markdown to HTML is exposed without authentication. A maliciously crafted markdown payload can cause the server to spend excessive time converting it, leading to a denial of service. The server becomes unresponsive to other requests until the conversion is complete.
A denial-of-service vulnerability has been identified in open-webui version 0.3.8. The issue arises from an endpoint that converts markdown to HTML, which is exposed without authentication. A maliciously crafted markdown payload can be sent to this endpoint, causing the server to spend an excessive amount of time processing the conversion. As a result, the server becomes unresponsive to other requests until the conversion is complete, leading to a significant degradation of service.
It is recommended to implement authentication for the markdown conversion endpoint and to sanitize or detect excessively large payloads before processing.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 20, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://huntr.com/bounties/f8156ca5-1328-480f-a72b-8d3dfdad87dc | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openwebui open webui | 0.3.8 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2025 | CVE Modified | [email protected] |
| Jul 21, 2025 | Initial Analysis | [email protected] |
| Mar 20, 2025 | New CVE Received | [email protected] |