CVE-2024-11822CWE-918

Server-Side Request Forgery (SSRF) in langgenius/dify

Medium · published March 20, 2025

CVSS v3.0
6.5
EPSS
1%
Percentile
48.3
In the wild
Unconfirmed
What it is

langgenius/dify version 0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability. The vulnerability exists due to improper handling of the api_endpoint parameter, allowing an attacker to make direct requests to internal network services. This can lead to unauthorized access to internal servers and potentially expose sensitive information, including access to the AWS metadata endpoint.

The record
Technical detail
CVSS v3.0
6.5 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00607 · 48.3th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-03-20T10:09Z
EPSS history
Timeline
  • 20 MAR 10:09Z
    Server-Side Request Forgery (SSRF) in langgenius/dify
    cvelistv5