PT-2025-12275 · Llava · Llava

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-9311

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions haotian-liu/llava version 1.2.0

Description A Cross-Site Request Forgery (CSRF) issue allows an attacker to upload files with malicious content without authentication or user interaction. The uploaded file is stored in a predictable path, enabling the attacker to execute arbitrary JavaScript code in the context of the victim's browser by visiting the crafted file URL. This can lead to theft of sensitive information, session hijacking, or other actions compromising the security and privacy of the victim.

Recommendations For haotian-liu/llava version 1.2.0, consider disabling file upload functionality until a patch is available to prevent exploitation of this issue. Restrict access to predictable paths where uploaded files are stored to minimize the risk of arbitrary JavaScript code execution. Avoid using the application until a fixed version is released. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-9311

Affected Products

Llava

References · 4

• 🔥 https://huntr.com/bounties/15b18b85-5a6b-43e7-bc65-6b4772871e98 · Exploit
• https://osv.dev/vulnerability/CVE-2024-9311 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9311 · Security Note
• https://twitter.com/CVEnew/status/1902671121658396728 · Twitter Post