CVE-2024-11822

HIGH

7.5

Beschreibung

langgenius/dify version 0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability. The vulnerability exists due to improper handling of the api_endpoint parameter, allowing an attacker to make direct requests to internal network services. This can lead to unauthorized access to internal servers and potentially expose sensitive information, including access to the AWS metadata endpoint.

CVE Details

CVSS v3.1 Bewertung7.5

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht3/20/2025

Zuletzt geandert4/1/2025

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

dify:dify

Schwachen (CWE)

CWE-918

Referenzen

https://huntr.com/bounties/f3042029-5d4e-41c6-850d-bbe02fae6592(security@huntr.dev)

https://huntr.com/bounties/f3042029-5d4e-41c6-850d-bbe02fae6592(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.