CVE-2024-7035: 
Python vulnerability analysis and mitigation

In version v0.3.8 of open-webui/open-webui, a Cross-Site Request Forgery (CSRF) vulnerability was identified where sensitive actions such as deleting and resetting are performed using the GET method. The vulnerability was disclosed on March 20, 2025, affecting multiple endpoints including /rag/api/v1/reset, /rag/api/v1/reset/db, /api/v1/memories/reset, and /rag/api/v1/reset/uploads (NVD).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) with a CVSS v3.0 base score of 6.9 (MEDIUM). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring high privileges (PR:H) and user interaction (UI:R). The scope is changed (S:C), with no impact on confidentiality (C:N), high impact on integrity (I:H), and low impact on availability (A:L) (NVD).

The vulnerability impacts both the availability and integrity of the application by allowing attackers to perform sensitive actions through CSRF attacks. An unaware user can unintentionally perform sensitive actions such as deleting and resetting data by simply visiting a malicious site or through top-level navigation (NVD).

The vulnerability can be exploited through Cross-Site Request Forgery attacks where an attacker can trick users into performing sensitive actions by visiting malicious sites or through top-level navigation. The attack requires high privileges but can be executed with low attack complexity (NVD).