CVE-2024-12068: high-severity vulnerability in haotian-liu/llava
Server-Side Request Forgery in haotian-liu/llava
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.7%
A Server-Side Request Forgery (SSRF) vulnerability was discovered in haotian-liu/llava, affecting version git c121f04. This vulnerability allows an attacker to make the server perform HTTP requests to arbitrary URLs, potentially accessing sensitive data that is only accessible from the server, such as AWS metadata credentials.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
haotian-liu · haotian-liu/llavaRelated CVEs — haotian-liu/llava
In the same product, most dangerous first.
CVE-2024-12065HIGHLocal File Inclusion in haotian-liu/llavaEPSS 0.9%CVE-2024-12070HIGHDenial of Service in haotian-liu/llavaEPSS 0.9%CVE-2024-11449HIGHServer-Side Request Forgery in haotian-liu/llavaEPSS 0.7%CVE-2024-10225HIGHDenial of Service in haotian-liu/llavaEPSS 0.6%CVE-2024-9308MEDIUMOpen Redirect in haotian-liu/llavaEPSS 0.5%CVE-2024-9309CRITICALSSRF in POST /worker_generate_stream API endpoint in haotian-liu/llavaEPSS 0.5%