Verba
Monthly
Server-side request forgery in Weaviate's Verba (GoldenVerba) RAG application version 2.1.3 lets unauthenticated remote attackers coerce the server into issuing arbitrary outbound HTTP GET requests. The flaw stems from a same-origin middleware bypass: any Origin header prefixed with a single quote defeats the localhost origin check, after which attacker-supplied host and port values passed to the /api/connect endpoint are fetched by the server. No public exploit code exists, but a detailed VulnCheck advisory and a third-party technical write-up document the exact bypass; there is no CISA KEV listing and EPSS was not provided.
Stored XSS in Verba's login audit logging subsystem allows unauthenticated remote attackers to inject arbitrary JavaScript by supplying a malicious username during a failed login attempt. The payload persists unsanitized in application logs and executes within an administrator's browser session when the log viewer is accessed, enabling potential session hijacking or credential theft. No active exploitation has been confirmed (absent from CISA KEV; EPSS 0.17% at 38th percentile), and a vendor-released fix is available in version 10.0.6.
Server-side request forgery in Weaviate's Verba (GoldenVerba) RAG application version 2.1.3 lets unauthenticated remote attackers coerce the server into issuing arbitrary outbound HTTP GET requests. The flaw stems from a same-origin middleware bypass: any Origin header prefixed with a single quote defeats the localhost origin check, after which attacker-supplied host and port values passed to the /api/connect endpoint are fetched by the server. No public exploit code exists, but a detailed VulnCheck advisory and a third-party technical write-up document the exact bypass; there is no CISA KEV listing and EPSS was not provided.
Stored XSS in Verba's login audit logging subsystem allows unauthenticated remote attackers to inject arbitrary JavaScript by supplying a malicious username during a failed login attempt. The payload persists unsanitized in application logs and executes within an administrator's browser session when the log viewer is accessed, enabling potential session hijacking or credential theft. No active exploitation has been confirmed (absent from CISA KEV; EPSS 0.17% at 38th percentile), and a vendor-released fix is available in version 10.0.6.