CVE-2024-8099: fallo de gravedad alta en vanna-ai/vanna
Server-Side Request Forgery (SSRF) in vanna-ai/vanna
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.3epss 0.4%
A Server-Side Request Forgery (SSRF) vulnerability exists in the latest version of vanna-ai/vanna when using DuckDB as the database. An attacker can exploit this vulnerability by submitting crafted SQL queries that leverage DuckDB's default features, such as `read_csv`, `read_csv_auto`, `read_text`, and `read_blob`, to make unauthorized requests to internal or external resources. This can lead to unauthorized access to sensitive data, internal systems, and potentially further attacks.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Productos afectados
vanna-ai · vanna-ai/vannaCVEs relacionadas — vanna-ai/vanna
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-5827CRITICALArbitrary File Write by Prompt Injection via DuckDB SQL in vanna-ai/vannaEPSS 3.4%CVE-2024-5826CRITICALRemote Code Execution via Prompt Injection in vanna-ai/vannaEPSS 0.9%CVE-2024-7764HIGHSQL Injection in vanna-ai/vannaEPSS 0.8%CVE-2024-8055HIGHLocal File Read (LFI) by Prompt Injection via SnowFlake SQL in vanna-ai/vannaEPSS 0.7%CVE-2024-5753HIGHLocal File Read (LFI) by Prompt Injection via Postgres SQL in vanna-ai/vannaEPSS 0.6%CVE-2024-6841MEDIUMCSRF in vanna-ai/vannaEPSS 0.2%