CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2024-12068: Server-Side Request Forgery in haotian-liu/llava
7.5
CVSS
Description
A Server-Side Request Forgery (SSRF) vulnerability was discovered in haotian-liu/llava, affecting version git c121f04. This vulnerability allows an attacker to make the server perform HTTP requests to arbitrary URLs, potentially accessing sensitive data that is only accessible from the server, such as AWS metadata credentials.
Classification
CVE ID: CVE-2024-12068
CVSS Base Severity: HIGH
CVSS Base Score: 7.5
CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Problem Types
CWE-918 Server-Side Request Forgery (SSRF)Affected Products
Vendor: haotian-liu
Product: haotian-liu/llava
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.04% (probability of being exploited)
EPSS Percentile: 12.68% (scored less or equal to compared to others)
EPSS Date: 2025-04-18 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2024-12068https://huntr.com/bounties/9d0b908d-63cd-4d62-91ff-6ceef3183752