CVE-2024-4851highCWE-918

CVE-2024-4851: fallo de gravedad alta en stangirard/quivr

SSRF Vulnerability in stangirard/quivr

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear stangirard/quivr

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.7epss 0.6%
A Server-Side Request Forgery (SSRF) vulnerability exists in the stangirard/quivr application, version 0.0.204, which allows attackers to access internal networks. The vulnerability is present in the crawl endpoint where the 'url' parameter can be manipulated to send HTTP requests to arbitrary URLs, thereby facilitating SSRF attacks. The affected code is located in the backend/routes/crawl_routes.py file, specifically within the crawl_endpoint function. This issue could allow attackers to interact with internal services that are accessible from the server hosting the application.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Productos afectados
stangirard · stangirard/quivr
CVEs relacionadas — stangirard/quivr

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-9229HIGHDenial of Service (DoS) via Multipart Boundary in stangirard/quivrEPSS 0.8%CVE-2024-6583MEDIUMPath Traversal in stangirard/quivrEPSS 0.6%CVE-2024-5885HIGHServer-Side Request Forgery (SSRF) in stangirard/quivrEPSS 0.6%CVE-2024-6229MEDIUMStored XSS in stangirard/quivrEPSS 0.3%