PT-2025-12143 · Bentoml · Bentoml

Published 2025-03-20 · Updated 2025-03-21 · CVE-2024-12760

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions bentoml/bentoml version 1.3.9

Description An open redirect issue allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This can be exploited for phishing attacks, malware distribution, and credential theft.

Recommendations For bentoml/bentoml version 1.3.9, consider validating user-inputted URLs to prevent redirects to unauthorized sites as a temporary workaround. Restrict access to sensitive operations that rely on user-supplied URLs to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2024-12760

GHSA-564P-RX2Q-4C8V

Affected Products

Bentoml

References · 7

• https://osv.dev/vulnerability/GHSA-564p-rx2q-4c8v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-12760 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-4940 · Security Note
• https://github.com/bentoml/BentoML · Note
• https://twitter.com/CVEnew/status/1902968876893344023 · Twitter Post
• https://huntr.com/bounties/2a284ff6-cc6c-4a10-b72e-1bb31c842bca · Note
• https://huntr.com/bounties/35aaea93-6895-4f03-9c1b-cd992665aa60 · Note