CyberRota Analysis
AI-GeneratedThe vulnerability in Stable Diffusion WebUI versions up to 1.10.1 allows unauthenticated attackers to exploit the /sdapi/v1/cmd-flags endpoint, which discloses sensitive credential information, including usernames and passwords, in cleartext. This could lead to unauthorized access to the application, compromising its integrity and security. Organizations using this software should prioritize immediate remediation to protect against potential credential theft and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradio_auth and api_auth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured usernames and passwords, then use them to authenticate to the interface and access the application.