CVE-2024-12068CWE-918

Server-Side Request Forgery in haotian-liu/llava

High · published March 20, 2025

CVSS v3.0
7.5
EPSS
1%
Percentile
52.7
In the wild
Unconfirmed
What it is

A Server-Side Request Forgery (SSRF) vulnerability was discovered in haotian-liu/llava, affecting version git c121f04. This vulnerability allows an attacker to make the server perform HTTP requests to arbitrary URLs, potentially accessing sensitive data that is only accessible from the server, such as AWS metadata credentials.

The record
Technical detail
CVSS v3.0
7.5 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00700 · 52.7th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-03-20T10:08Z
EPSS history
Timeline
  • 20 MAR 10:08Z
    Server-Side Request Forgery in haotian-liu/llava
    cvelistv5