CVE-2024-9309: falha crítica em haotian-liu/llava
SSRF in POST /worker_generate_stream API endpoint in haotian-liu/llava
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.3epss 0.5%
A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Controller API Server in haotian-liu/llava version v1.2.0 (LLaVA-1.6). This vulnerability allows attackers to exploit the victim Controller API Server's credentials to perform unauthorized web actions or access unauthorized web resources.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Produtos afetados
haotian-liu · haotian-liu/llavaCVEs relacionadas — haotian-liu/llava
No mesmo produto, das mais perigosas para as menos.
CVE-2024-12065HIGHLocal File Inclusion in haotian-liu/llavaEPSS 0.9%CVE-2024-12070HIGHDenial of Service in haotian-liu/llavaEPSS 0.9%CVE-2024-12068HIGHServer-Side Request Forgery in haotian-liu/llavaEPSS 0.7%CVE-2024-11449HIGHServer-Side Request Forgery in haotian-liu/llavaEPSS 0.7%CVE-2024-10225HIGHDenial of Service in haotian-liu/llavaEPSS 0.6%CVE-2024-9308MEDIUMOpen Redirect in haotian-liu/llavaEPSS 0.5%