CVE-2024-28224

Katalog CVE

CVSS 6.6 · Medium EPSS 0,35%

Kerentanan Origin Validation Error pada ollama. Skor CVSS 3.1 6.6 (Medium) menurut CISA ADP.

Deskripsi (NVD)

Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion).

Rincian

Terbit di NVD

8 April 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.6 (Medium), sumber CISA ADP
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-346: Origin Validation Error

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 27,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ollama/ollama/releases release notes
• https://research.nccgroup.com/2024/04/08/technical-advisory-ollama-dns-rebinding-attack-cve-2024-28224/ not applicable
• https://www.nccgroup.trust/us/our-research/?research=Technical+advisories broken link