Cinnamon
Monthly
Broken access control in Kotaemon through 0.12.0 lets any user act on conversations they do not own by supplying arbitrary conversation identifiers to the select_conv, delete_conv, rename_conv, and on_set_public_conversation handlers in control.py. Because these functions never verify that the requesting user owns the referenced conversation, an attacker can read other users' chat histories and delete or rename their conversations. Reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in kotaemon (Cinnamon) versions through 0.12.0 allows unauthenticated attackers to run arbitrary commands via the check_connection endpoint, which insecurely deserializes attacker-supplied YAML/JSON. By setting the __type__ field to subprocess.check_output with chosen arguments, an attacker instantiates arbitrary Python objects and executes OS commands with the application's process privileges. Publicly available exploit code exists (VulnCheck advisory and upstream issue), and the CVSS 4.0 base score is 9.3, though there is no public exploit identified as actively exploited.
An issue was discovered in Cinnamon kotaemon 0.11.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Plaintext password storage in Kotaemon 0.11.0 in the client's localStorage. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross site scripting (XSS) vulnerability in Kotaemon 0.11.0 allowing attackers to execute arbitrary code via a crafted PDF. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An issue was discovered in Cinnamon 1.9.2 through 3.8.6. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Broken access control in Kotaemon through 0.12.0 lets any user act on conversations they do not own by supplying arbitrary conversation identifiers to the select_conv, delete_conv, rename_conv, and on_set_public_conversation handlers in control.py. Because these functions never verify that the requesting user owns the referenced conversation, an attacker can read other users' chat histories and delete or rename their conversations. Reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in kotaemon (Cinnamon) versions through 0.12.0 allows unauthenticated attackers to run arbitrary commands via the check_connection endpoint, which insecurely deserializes attacker-supplied YAML/JSON. By setting the __type__ field to subprocess.check_output with chosen arguments, an attacker instantiates arbitrary Python objects and executes OS commands with the application's process privileges. Publicly available exploit code exists (VulnCheck advisory and upstream issue), and the CVSS 4.0 base score is 9.3, though there is no public exploit identified as actively exploited.
An issue was discovered in Cinnamon kotaemon 0.11.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Plaintext password storage in Kotaemon 0.11.0 in the client's localStorage. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross site scripting (XSS) vulnerability in Kotaemon 0.11.0 allowing attackers to execute arbitrary code via a crafted PDF. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An issue was discovered in Cinnamon 1.9.2 through 3.8.6. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.