What is CVE-2024-12376?

CVE-2024-12376 is a high-severity vulnerability in Lm-Sys Fastchat, classified under Server-Side Request Forgery (SSRF). CVSS score: 7.5/10. Published 2025-03-20.

How severe is CVE-2024-12376?

High severity. CVSS v3 base score is 7.5 out of 10.

SSRF in Lm-Sys Fastchat

CVE-2024-12376

A Server-Side Request Forgery (SSRF) vulnerability was identified in the lm-sys/fastchat web server, specifically in the affected version git 2c68a13. This vulnerability allows an attacker to access internal server resources and data that are otherwise inaccessible, such as AWS metadata credentials.

Vulnerability class: SSRF (Server-Side Request Forgery)

EPSS: 0.007 (49.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Lm-sys Fastchat — versions 2024-10-05
Lm-sys Lm-sys/fastchat — versions unspecified

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

security@huntr.dev (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2024-12376?: CVE-2024-12376 is a high-severity vulnerability in Lm-Sys Fastchat, classified under Server-Side Request Forgery (SSRF). CVSS score: 7.5/10. Published 2025-03-20.
How severe is CVE-2024-12376?: High severity. CVSS v3 base score is 7.5 out of 10.