CVE-2024-9308CWE-601
Open Redirect in haotian-liu/llava
Medium · published March 20, 2025
What it is
An open redirect vulnerability in haotian-liu/llava version v1.2.0 (LLaVA-1.6) allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This can be exploited for phishing attacks, malware distribution, and credential theft.
The record
Technical detail
- CVSS v3.0
- 6.1 · MEDIUM
- Vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00530 · 43.9th percentile
- Weakness
- CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
- Published
- 2025-03-20T10:10Z
EPSS history
Timeline