CVE-2024-7035: 
Python vulnerability analysis and mitigation

In version v0.3.8 of open-webui/open-webui, a Cross-Site Request Forgery (CSRF) vulnerability was identified where sensitive actions such as deleting and resetting are performed using the GET method. The vulnerability was disclosed on March 20, 2025, affecting multiple endpoints including /rag/api/v1/reset, /rag/api/v1/reset/db, /api/v1/memories/reset, and /rag/api/v1/reset/uploads (NVD).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) with a CVSS v3.0 base score of 6.9 (MEDIUM). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring high privileges (PR:H) and user interaction (UI:R). The scope is changed (S:C), with no impact on confidentiality (C:N), high impact on integrity (I:H), and low impact on availability (A:L) (NVD).

The vulnerability impacts both the availability and integrity of the application by allowing attackers to perform sensitive actions through CSRF attacks. An unaware user can unintentionally perform sensitive actions such as deleting and resetting data by simply visiting a malicious site or through top-level navigation (NVD).