CVE-2024-6095

Katalog CVE

CVSS 5.8 · Medium EPSS 2,7%

Kerentanan Server-Side Request Forgery (SSRF) pada mudler localai. Skor CVSS 3.1 5.8 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability in the /models/apply endpoint of mudler/localai versions 2.15.0 allows for Server-Side Request Forgery (SSRF) and partial Local File Inclusion (LFI). The endpoint supports both http(s):// and file:// schemes, where the latter can lead to LFI. However, the output is limited due to the length of the error message. This vulnerability can be exploited by an attacker with network access to the LocalAI instance, potentially allowing unauthorized access to internal HTTP(s) servers and partial reading of local files. The issue is fixed in version 2.17.

Rincian

Terbit di NVD

6 Juli 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

2,7% peluang dieksploitasi; lebih tinggi dari 85,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mudler/localai/commit/2fc6fe806b903ac0a70218b21b5c84443a1b0866 patch
• https://huntr.com/bounties/4799262d-72dc-43c8-bc99-81d0dce996dc exploit · advisory pihak ketiga