What is CVE-2024-12236?

CVE-2024-12236 is a medium-severity vulnerability in Google Vertex Gemini API, classified under Improper Handling of Exceptional Conditions. CVSS score: 5.5/10. Published 2024-12-10.

How severe is CVE-2024-12236?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Vulnerability in Google Vertex Gemini API

CVE-2024-12236

A security issue exists in Vertex Gemini API for customers using VPC-SC. By utilizing a custom crafted file URI for image input, data exfiltration is possible due to requests being routed outside the VPC-SC security perimeter, circumventing the intended security restrictions of VPC-SC. No further fix actions are needed. Google Cloud Platform implemented a fix to return an error message when a media file URL is specified in the fileUri parameter and VPC Service Controls is enabled. Other use cases are unaffected.

EPSS: 0.001 (0.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Google Vertex_gemini_api
Google Cloud Platform Vertex Gemini Api — versions 0

Weakness classification (CWE)

CWE-755 — Improper Handling of Exceptional Conditions

References

cve-coordination@google.com (Vendor Advisory)

Frequently asked questions

What is CVE-2024-12236?: CVE-2024-12236 is a medium-severity vulnerability in Google Vertex Gemini API, classified under Improper Handling of Exceptional Conditions. CVSS score: 5.5/10. Published 2024-12-10.
How severe is CVE-2024-12236?: Medium severity. CVSS v3 base score is 5.5 out of 10.