CVE-2024-24566
Medium
Description
Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. When the application is password-protected (deployed with the `ACCESS_CODE` option), it is possible to access plugins without proper authorization (without password). This vulnerability is patched in 0.122.4.
SeverityMedium
CVSS5.3
Exploit probability—
ProductLobehub Lobe Chat
PublishedJan 31, 2024
First seenJan 31, 2024
Weakness typeCWE-284Improper access control
How to fix
Update
- lobehub lobe_chat0.122.4 or later
- @lobehub/chat0.122.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lobehub lobe_chat | v < 0.122.4 | 0.122.4 |
| @lobehub/chatnpm | v < 0.122.4 | 0.122.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.