CVE-2024-12068: fallo de gravedad alta en haotian-liu/llava
Server-Side Request Forgery in haotian-liu/llava
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 0.7%
A Server-Side Request Forgery (SSRF) vulnerability was discovered in haotian-liu/llava, affecting version git c121f04. This vulnerability allows an attacker to make the server perform HTTP requests to arbitrary URLs, potentially accessing sensitive data that is only accessible from the server, such as AWS metadata credentials.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
haotian-liu · haotian-liu/llavaCVEs relacionadas — haotian-liu/llava
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-12065HIGHLocal File Inclusion in haotian-liu/llavaEPSS 0.9%CVE-2024-12070HIGHDenial of Service in haotian-liu/llavaEPSS 0.9%CVE-2024-11449HIGHServer-Side Request Forgery in haotian-liu/llavaEPSS 0.7%CVE-2024-10225HIGHDenial of Service in haotian-liu/llavaEPSS 0.6%CVE-2024-9308MEDIUMOpen Redirect in haotian-liu/llavaEPSS 0.5%CVE-2024-9309CRITICALSSRF in POST /worker_generate_stream API endpoint in haotian-liu/llavaEPSS 0.5%