CVE-2024-12882highCWE-918

CVE-2024-12882: high-severity vulnerability in comfyanonymous/comfyui

SSRF in comfyanonymous/comfyui

Published

Follow this CVE+ Monitor comfyanonymous/comfyui

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.8%
comfyanonymous/comfyui version v0.2.4 suffers from a non-blind Server-Side Request Forgery (SSRF) vulnerability. This vulnerability can be exploited by combining the REST APIs `POST /internal/models/download` and `GET /view`, allowing attackers to abuse the victim server's credentials to access unauthorized web resources.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
comfyanonymous · comfyanonymous/comfyui
Related CVEs — comfyanonymous/comfyui

In the same product, most dangerous first.

CVE-2024-10099MEDIUMStored XSS in comfyanonymous/comfyuiEPSS 0.4%CVE-2024-10481MEDIUMCross-Site Request Forgery (CSRF) in comfyanonymous/comfyuiEPSS 0.2%