CVE-2024-11449 json
Server-Side Request Forgery in haotian-liu/llava
published 2025-03-20 19 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-7044
- cvss
- 7.5
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 53%
- public exploits
- 0
- none known
Summary
A vulnerability in haotian-liu/llava version 1.2.0 (LLaVA-1.6) allows for Server-Side Request Forgery (SSRF) through the /run/predict endpoint. An attacker can gain unauthorized access to internal networks or the AWS metadata endpoint by sending crafted requests that exploit insufficient validation of the path parameter. This flaw can lead to unauthorized network access, sensitive data exposure, and further exploitation within the network.
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 19 mo ago
Exploit prediction
0.70% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- huntr.com https://huntr.com/bounties/e96aba28-d564-4ecb-ab77-350511d2e1ee referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected products
- haotian-liu haotian-liu/llava
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
huntr.com
/bounties/e96aba28-d564-4ecb-ab77-350511d2e1ee
exploit, third-party-advisory
Sources
- CVE List CVE-2024-11449
- NVD CVE-2024-11449
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.