CVE-2024-12882highCWE-918

CVE-2024-12882: falha de alta gravidade em comfyanonymous/comfyui

SSRF in comfyanonymous/comfyui

Publicada em

Seguir esta CVE+ Monitorar comfyanonymous/comfyui

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.8%
comfyanonymous/comfyui version v0.2.4 suffers from a non-blind Server-Side Request Forgery (SSRF) vulnerability. This vulnerability can be exploited by combining the REST APIs `POST /internal/models/download` and `GET /view`, allowing attackers to abuse the victim server's credentials to access unauthorized web resources.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
comfyanonymous · comfyanonymous/comfyui
CVEs relacionadas — comfyanonymous/comfyui

No mesmo produto, das mais perigosas para as menos.

CVE-2024-10099MEDIUMStored XSS in comfyanonymous/comfyuiEPSS 0.4%CVE-2024-10481MEDIUMCross-Site Request Forgery (CSRF) in comfyanonymous/comfyuiEPSS 0.2%