CVE-2024-9309

critical · 9.3

A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Controller API Server in haotian-liu/llava version v1.2.0 (LLaVA-1.6). This vulnerability allows attackers to exploit the victim Controller API Server's credentials to perform unauthorized web actions or access unauthorized web resources.

9.3

CVSS

0.5%

EPSS (exploit prob.)

41st

EPSS percentile

2025-03-20

Published

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Weaknesses

CWE-918

Affected products

Vendor	Product	Affected versions
hliu	llava	1.2.0

Check a specific version with /api/v1/cve/match.

References

https://huntr.com/bounties/2ba6be79-5c90-48fa-99cb-82503ea49a12

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-9309