CVE-2024-11449

🗓️ 20 Mar 2025 10:08:53Reported by @huntr_aiType

cve🔗 web.nvd.nist.gov👁 39 Views🌐 WEB

Vulnerability in LLaVA-1.6 allows SSRF, risking unauthorized network access and data exposure.

Reporter	Title	Published	Views	Family All 7
CNNVD	LLaVA 代码问题漏洞	20 Mar 202500:00	–	cnnvd
Cvelist	CVE-2024-11449 Server-Side Request Forgery in haotian-liu/llava	20 Mar 202510:08	–	cvelist
EUVD	EUVD-2025-7044	3 Oct 202520:07	–	euvd
NVD	CVE-2024-11449	20 Mar 202510:15	–	nvd
Positive Technologies	PT-2025-12107 · Llava · Llava	20 Mar 202500:00	–	ptsecurity
RedhatCVE	CVE-2024-11449	22 Mar 202511:40	–	redhatcve
Vulnrichment	CVE-2024-11449 Server-Side Request Forgery in haotian-liu/llava	20 Mar 202510:08	–	vulnrichment

NVD

Node

hliu large_language_and_vision_assistantMatch1.2.0

[
  {
    "vendor": "haotian-liu",
    "product": "haotian-liu/llava",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "versionType": "custom",
        "lessThanOrEqual": "latest"
      }
    ]
  }
]

Source	Link
huntr	www.huntr.com/bounties/e96aba28-d564-4ecb-ab77-350511d2e1ee

Parameter	Position	Path	Description	CWE
path	path	/run/predict	SSRF in /run/predict due to insufficient validation of the path parameter	CWE-918

14 Jul 2025 17:36Current

7.6High risk

Vulners AI Score7.6

CVSS 37.5

EPSS0.00395

SSVC

CWE-918