CVSS 3.0
9.3 criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:NCVE-2024-9309
Critical (9.3) in hliu llava. EPSS 0.5% chance of exploitation in the next 30 days.
A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Controller API Server in haotian-liu/llava version v1.2.0 (LLaVA-1.6). This vulnerability allows attackers to exploit the victim Controller API Server's credentials to perform unauthorized web actions or access unauthorized web resources.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-10-31)
- CWE
- CWE-918
- Published
- Modified
- Record from
- the NVD, synced
Affected
- hliu:llava