CVE-2024-12775

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-12775

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-12775.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-12775

Published

2025-03-20T10:09:23Z

Modified

2026-10-28T02:30:53Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

SSRF in langgenius/dify

Details

langgenius/dify version 0.10.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the test functionality for the Create Custom Tool option via the REST API POST /console/api/workspaces/current/tool-provider/api/test/pre. Attackers can set the url in the servers dictionary in OpenAI's schema with arbitrary URL targets, allowing them to abuse the victim server's credentials to access unauthorized web resources.

Database specific

{
    "cna_assigner": "@huntr_ai",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/12xxx/CVE-2024-12775.json"
}

References

Affected packages

Git / github.com/langgenius/dify

Affected ranges

Type

GIT

Repo

https://github.com/langgenius/dify

Events

Introduced

400392230b47fff5d011b55afd8b0f8b8083ade0

Last Affected

400392230b47fff5d011b55afd8b0f8b8083ade0

Database specific

Show details

{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:langgenius:dify:0.10.1:*:*:*:*:node.js:*:*",
            "range": [
                {
                    "introduced": "0.10.1"
                },
                {
                    "last_affected": "0.10.1"
                }
            ],
            "source": "CPE_STRING"
        }
    ]
}

Affected versions

0.*

0.10.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-12775.json"