CVE-2024-4851highCWE-918

CVE-2024-4851: falha de alta gravidade em stangirard/quivr

SSRF Vulnerability in stangirard/quivr

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar stangirard/quivr

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.7epss 0.6%
A Server-Side Request Forgery (SSRF) vulnerability exists in the stangirard/quivr application, version 0.0.204, which allows attackers to access internal networks. The vulnerability is present in the crawl endpoint where the 'url' parameter can be manipulated to send HTTP requests to arbitrary URLs, thereby facilitating SSRF attacks. The affected code is located in the backend/routes/crawl_routes.py file, specifically within the crawl_endpoint function. This issue could allow attackers to interact with internal services that are accessible from the server hosting the application.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Produtos afetados
stangirard · stangirard/quivr
CVEs relacionadas — stangirard/quivr

No mesmo produto, das mais perigosas para as menos.

CVE-2024-9229HIGHDenial of Service (DoS) via Multipart Boundary in stangirard/quivrEPSS 0.8%CVE-2024-6583MEDIUMPath Traversal in stangirard/quivrEPSS 0.6%CVE-2024-5885HIGHServer-Side Request Forgery (SSRF) in stangirard/quivrEPSS 0.6%CVE-2024-6229MEDIUMStored XSS in stangirard/quivrEPSS 0.3%