CVE-2024-11449CWE-918

Server-Side Request Forgery in haotian-liu/llava

High · published March 20, 2025

CVSS v3.0
7.5
EPSS
1%
Percentile
52.6
In the wild
Unconfirmed
What it is

A vulnerability in haotian-liu/llava version 1.2.0 (LLaVA-1.6) allows for Server-Side Request Forgery (SSRF) through the /run/predict endpoint. An attacker can gain unauthorized access to internal networks or the AWS metadata endpoint by sending crafted requests that exploit insufficient validation of the path parameter. This flaw can lead to unauthorized network access, sensitive data exposure, and further exploitation within the network.

The record
Technical detail
CVSS v3.0
7.5 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00700 · 52.6th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-03-20T10:08Z
EPSS history
Timeline
  • 20 MAR 10:08Z
    Server-Side Request Forgery in haotian-liu/llava
    cvelistv5