What is CVE-2024-4851?

CVE-2024-4851 is a high-severity vulnerability in Quivr, classified under Server-Side Request Forgery (SSRF). CVSS score: 7.7/10. Published 2024-06-06.

How severe is CVE-2024-4851?

High severity. CVSS v3 base score is 7.7 out of 10.

Is CVE-2024-4851 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

SSRF in Quivr

CVE-2024-4851

A Server-Side Request Forgery (SSRF) vulnerability exists in the stangirard/quivr application, version 0.0.204, which allows attackers to access internal networks. The vulnerability is present in the crawl endpoint where the 'url' parameter can be manipulated to send HTTP requests to arbitrary URLs, thereby facilitating SSRF attacks. The affected code is located in the backend/routes/crawl_routes.py file, specifically within the crawl_endpoint function. This issue could allow attackers to interact with internal services that are accessible from the server hosting the application.

Vulnerability class: SSRF (Server-Side Request Forgery)

EPSS: 0.006 (44.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.

Affected products

Quivr — versions 0.0.204
Stangirard Stangirard/quivr — versions unspecified

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

security@huntr.dev (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2024-4851?: CVE-2024-4851 is a high-severity vulnerability in Quivr, classified under Server-Side Request Forgery (SSRF). CVSS score: 7.7/10. Published 2024-06-06.
How severe is CVE-2024-4851?: High severity. CVSS v3 base score is 7.7 out of 10.
Is CVE-2024-4851 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.