CVE-2024-11449
CVSS 3.0 Score 7.5 of 10 (high)
Details
Published Mar 20, 2025
CWE ID 918
Summary
CVE-2024-11449 is a newly identified vulnerability affecting version 1.2.0 of haotian-liu/llava (LLaVA-1.6). This issue permits Server-Side Request Forgery (SSRF) attacks through the /run/predict endpoint. An attacker can exploit insufficient validation of the path parameter to make unauthorized requests, potentially gaining access to internal networks or the AWS metadata endpoint. The resulting unauthorized network access, sensitive data exposure, and further exploitation within the network pose significant security risks.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.