CVE-2024-12068 — Server-Side Request Forgery in haotian-liu/llava

CVE-2024-12068

Server-Side Request Forgery in haotian-liu/llava PUBLISHED

Description (CNA)

A Server-Side Request Forgery (SSRF) vulnerability was discovered in haotian-liu/llava, affecting version git c121f04. This vulnerability allows an attacker to make the server perform HTTP requests to arbitrary URLs, potentially accessing sensitive data that is only accessible from the server, such as AWS metadata credentials.

Affected (CNA)

Vendor / product	Versions
haotian-liu / haotian-liu/llava	affected unspecified through latest

CWE

CWE-918

References

https://huntr.com/bounties/9d0b908d-63cd-4d62-91ff-6ceef3183752

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.