CVE-2024-12376CWE-918

Server Side Request Forgery in lm-sys/fastchat

High · published March 20, 2025

CVSS v3.0
7.5
EPSS
1%
Percentile
54.8
In the wild
Unconfirmed
What it is

A Server-Side Request Forgery (SSRF) vulnerability was identified in the lm-sys/fastchat web server, specifically in the affected version git 2c68a13. This vulnerability allows an attacker to access internal server resources and data that are otherwise inaccessible, such as AWS metadata credentials.

The record
Technical detail
CVSS v3.0
7.5 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00761 · 54.8th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-03-20T10:10Z
EPSS history
Timeline
  • 20 MAR 10:10Z
    Server Side Request Forgery in lm-sys/fastchat
    cvelistv5