CVE-2024-32965

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

Lobe Chat is an open-source, AI chat framework. Versions of lobe-chat prior to 1.19.13 have an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive information. The jwt token header X-Lobe-Chat-Auth strored proxy address and OpenAI API Key, can be modified to scan an internal network in the target lobe-web environment. This issue has been addressed in release version 1.19.13 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published
Nov 26, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-329665.8Static Web Server (SWS) is a tiny and fast production-ready web server suitable to serve static web files or assets. In affected versions ifCVE-2024-329675.3Zitadel is an open source identity management system. In case ZITADEL could not connect to the database, connection information including dbCVE-2024-329692.7vantage6 is an open-source infrastructure for privacy preserving analysis. Collaboration administrators can add extra organizations to theirCVE-2024-32976.5An issue in the Certificate Authenticated Session Establishment (CASE) protocol for establishing secure sessions between two devices, as impCVE-2024-329707.1Phlex is a framework for building object-oriented views in Ruby. In affected versions there is a potential cross-site scripting (XSS) vulnerCVE-2024-329719.0Apollo Router is a configurable, graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. The affected versCVE-2024-329727.5go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to 1.13.15, a vulnerable node can be made to cCVE-2024-329734.8Pluto is a superset of Lua 5.4 with a focus on general-purpose programming. In affected versions an attacker with the ability to actively inCVE-2024-329747.5Envoy is a cloud-native, open source edge and service proxy. A crash was observed in `EnvoyQuicServerStream::OnInitialHeadersComplete()` witCVE-2024-329757.5Envoy is a cloud-native, open source edge and service proxy. There is a crash at `QuicheDataReader::PeekVarInt62Length()`. It is caused by iCVE-2024-329767.5Envoy is a cloud-native, open source edge and service proxy. Envoyproxy with a Brotli filter can get into an endless loop during decompressiCVE-2024-329779.4OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.0 contain a vulnerab
CVE-2024-32965: High severity, CVSS 8.6 | Vulnix