CVE-2024-11822
Last modified
CVE-2024-11822 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. langgenius/dify version 0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability. The vulnerability exists due to improper handling of the api_endpoint parameter, allowing an attacker to make direct requests to internal network services. EPSS estimates a 0.56% chance of exploitation in the next 30 days.
Description
langgenius/dify version 0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability. The vulnerability exists due to improper handling of the api_endpoint parameter, allowing an attacker to make direct requests to internal network services. This can lead to unauthorized access to internal servers and potentially expose sensitive information, including access to the AWS metadata endpoint.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Dify | Dify | 0.9.1 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-11822?
How severe is CVE-2024-11822?
How do I fix CVE-2024-11822?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-11817A vulnerability was found in PHPGurukul User Registration & …9.8
- CVE-2024-11818A vulnerability classified as critical has been found in PHP…9.8
- CVE-2024-11819A vulnerability classified as critical was found in 1000 Pro…9.8
- CVE-2024-1182Uncontrolled Search Path Element vulnerability in Mitsubishi…7
- CVE-2024-11820A vulnerability, which was classified as problematic, has be…5.4
- CVE-2024-11821A privilege escalation vulnerability exists in langgenius/di…4.3
- CVE-2024-11823The Folder Gallery plugin for WordPress is vulnerable to Sto…6.1
- CVE-2024-11824A stored cross-site scripting (XSS) vulnerability exists in …7.6
- CVE-2024-11825The Broadstreet plugin for WordPress is vulnerable to Stored…6.4
- CVE-2024-11826The Quill Forms | The Best Typeform Alternative | Create Con…6.4
- CVE-2024-11827The Out of the Block: OpenStreetMap plugin for WordPress is …6.4
- CVE-2024-11828A denial of service (DoS) condition was discovered in GitLab…7.5
Are you affected by CVE-2024-11822?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST