CVE-2024-12068: falha de alta gravidade em haotian-liu/llava
Server-Side Request Forgery in haotian-liu/llava
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.7%
A Server-Side Request Forgery (SSRF) vulnerability was discovered in haotian-liu/llava, affecting version git c121f04. This vulnerability allows an attacker to make the server perform HTTP requests to arbitrary URLs, potentially accessing sensitive data that is only accessible from the server, such as AWS metadata credentials.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
haotian-liu · haotian-liu/llavaCVEs relacionadas — haotian-liu/llava
No mesmo produto, das mais perigosas para as menos.
CVE-2024-12065HIGHLocal File Inclusion in haotian-liu/llavaEPSS 0.9%CVE-2024-12070HIGHDenial of Service in haotian-liu/llavaEPSS 0.9%CVE-2024-11449HIGHServer-Side Request Forgery in haotian-liu/llavaEPSS 0.7%CVE-2024-10225HIGHDenial of Service in haotian-liu/llavaEPSS 0.6%CVE-2024-9308MEDIUMOpen Redirect in haotian-liu/llavaEPSS 0.5%CVE-2024-9309CRITICALSSRF in POST /worker_generate_stream API endpoint in haotian-liu/llavaEPSS 0.5%