ByteOS Network

NVD Vulnerability Details :

CVE-2024-11449

Analyzed

Source-security@huntr.dev

Published At-20 Mar, 2025 | 10:15

Updated At-14 Jul, 2025 | 17:36

A vulnerability in haotian-liu/llava version 1.2.0 (LLaVA-1.6) allows for Server-Side Request Forgery (SSRF) through the /run/predict endpoint. An attacker can gain unauthorized access to internal networks or the AWS metadata endpoint by sending crafted requests that exploit insufficient validation of the path parameter. This flaw can lead to unauthorized network access, sensitive data exposure, and further exploitation within the network.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.0	7.5	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Type: Secondary

Version: 3.0

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CPE Matches

hliu>>large_language_and_vision_assistant>>1.2.0

cpe:2.3:a:hliu:large_language_and_vision_assistant:1.2.0:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-918	Primary	security@huntr.dev

CWE ID: CWE-918

Type: Primary

Source: security@huntr.dev

References

Hyperlink	Source	Resource
https://huntr.com/bounties/e96aba28-d564-4ecb-ab77-350511d2e1ee	security@huntr.dev	Exploit Third Party Advisory

Hyperlink: https://huntr.com/bounties/e96aba28-d564-4ecb-ab77-350511d2e1ee

Source: security@huntr.dev

Resource:

Exploit

Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History