CVE-2024-10908

The CVE-2024-10908 entry describes an open redirect vulnerability in lm-sys/fastchat release 0.2.36. The issue allows remote, unauthenticated attackers to redirect users to arbitrary URLs, enabling phishing, malware distribution, and credential theft. Affected component: lm-sys/fastchat, version ...

FastChat 输入验证错误漏洞

FastChat is an open platform from LMSYS for training, deploying, and evaluating chatbots based on large language models. An input validation error vulnerability exists in FastChat version v0.2.36, which stems from an open redirection vulnerability that could lead to phishing attacks, malware...

FastChat 代码问题漏洞

FastChat is an open platform from LMSYS for training, deploying, and evaluating chatbots based on large language models. FastChat suffers from a code issue vulnerability that stems from server-side request forgery that could lead to internal resource access...

FastChat 资源管理错误漏洞

FastChat is an open platform from LMSYS for training, deploying, and evaluating chatbots based on large language models. A resource management error vulnerability exists in FastChat version v0.2.36, which stems from the server's inability to handle excessive characters at the end of multipart...

FastChat 资源管理错误漏洞

FastChat is an open platform from LMSYS for training, deploying and evaluating chatbots based on large language models. A resource management error vulnerability exists in FastChat version 0.2.36, which stems from improper handling of large filenames in the file upload feature and could lead to a...

FastChat 代码问题漏洞

FastChat is an open platform from LMSYS for training, deploying and evaluating chatbots based on large-scale language models. A code issue vulnerability exists in FastChat version 0.2.36, which stems from insufficient validation of path parameters and could lead to a server-side request forgery...

data-agora (=0.1.1), dtx (>=0.31.0 <=0.34.0) +10 more potentially affected by CVE-2024-10044 via fastchat (=0.1.0)

fastchat PYPI version =0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastchat and may be impacted: - data-agora =0.1.1 - dtx =0.31.0, =0.2.0, =0.18.3, =0.0.2, =0.4.0, =0.0.1, =0.1.3, =0.1.0, =0.1.0, =0.1.1 Source cves: CVE-2024-10044 Source...

Server-side Request Forgery (SSRF)

Overview fastchat is a fastchat with guidance support Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the workergeneratestream API endpoint. An attacker can exploit the victim controller API server's credentials to perform unauthorized web actions or...

CVE-2024-10044

CVE-2024-10044 describes a Server-Side Request Forgery (SSRF) in the lm-sys/fastchat Controller API Server, affecting the POST /worker_generate_stream endpoint. The vulnerability allows an attacker to misuse the controller API server’s credentials to perform unauthorized web actions or access res...

CVE-2024-10044 SSRF in POST /worker_generate_stream API endpoint in lm-sys/fastchat

A Server-Side Request Forgery SSRF vulnerability exists in the POST /workergeneratestream API endpoint of the Controller API Server in lm-sys/fastchat, as of commit e208d5677c6837d590b81cb03847c0b9de100765. This vulnerability allows attackers to exploit the victim controller API server's...

CVE-2024-10044 SSRF in POST /worker_generate_stream API endpoint in lm-sys/fastchat

A Server-Side Request Forgery SSRF vulnerability exists in the POST /workergeneratestream API endpoint of the Controller API Server in lm-sys/fastchat, as of commit e208d5677c6837d590b81cb03847c0b9de100765. This vulnerability allows attackers to exploit the victim controller API server's...

FastChat 代码问题漏洞

FastChat is LMSYS Org's is an open platform for training, deploying, and evaluating chatbots based on large language models. A code issue vulnerability exists in FastChat that stems from a server-side request forgery vulnerability in the POST/workergeneratestream API endpoint that allows an...