CVE-2024-10044

{"id": "CVE-2024-10044", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 3.9}]}, "published": "2024-12-30T12:15:05.990", "references": [{"url": "https://huntr.com/bounties/44633540-377d-4ac4-b3a3-c2d0fa19d0e6", "tags": ["Exploit", "Third Party Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Controller API Server in lm-sys/fastchat, as of commit e208d5677c6837d590b81cb03847c0b9de100765. This vulnerability allows attackers to exploit the victim controller API server's credentials to perform unauthorized web actions or access unauthorized web resources by combining it with the POST /register_worker endpoint."}, {"lang": "es", "value": "Existe una vulnerabilidad de server-side request forgery (SSRF) en el endpoint de la API POST /worker_generate_stream del servidor de API del controlador en lm-sys/fastchat, a partir de el commit e208d5677c6837d590b81cb03847c0b9de100765. Esta vulnerabilidad permite a los atacantes explotar las credenciales del servidor de API del controlador de la v\u00edctima para realizar acciones web no autorizadas o acceder a recursos web no autorizados al combinarlo con el endpoint POST /register_worker."}], "lastModified": "2025-07-29T23:26:03.040", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lm-sys:fastchat:2024-09-23:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9EDA117B-1FC5-4897-A6BA-91926B5ABA98"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}