CVE-2024-9309

Published: Mar 20, 2025

Modified: Mar 20, 2025

PUBLISHED

CVSS v3.0

9.3

CRITICAL

Description

A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Controller API Server in haotian-liu/llava version v1.2.0 (LLaVA-1.6). This vulnerability allows attackers to exploit the victim Controller API Server's credentials to perform unauthorized web actions or access unauthorized web resources.

Vendor	Product	Versions
haotian-liu	haotian-liu/llava	affected `unspecified - <= latest`

Weaknesses (CWE)

CWE-918

CVSS v3.0 Details

CVSS v3.0 Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

References

https://huntr.com/bounties/2ba6be79-5c90-48fa-99cb-82503ea49a12

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2024-9309

Description

Affected Products

Weaknesses (CWE)

CVSS v3.0 Details

References