CVE-2024-11603
CVSS 3.0 Score 7.5 of 10 (high)
Details
Published Mar 20, 2025
CWE ID 918
Summary
CVE-2024-11603 is a Server-Side Request Forgery (SSRF) vulnerability affecting version 0.2.36 of the lm-sys/fastchat software. The flaw is located in the `/queue/join?` endpoint and arises from inadequate validation of the path parameter. An attacker can exploit this weakness by sending crafted requests, leading to unauthorized access to internal networks or the AWS metadata endpoint. This exposure of sensitive data and compromise of internal servers poses a significant security risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.