CVE-2024-4851

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-4851
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-4851.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-4851
Published
2024-06-06T18:39:58Z
Modified
2026-09-06T03:45:32Z
Severity
  • 7.7 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Summary
SSRF Vulnerability in stangirard/quivr
Details

A Server-Side Request Forgery (SSRF) vulnerability exists in the stangirard/quivr application, version 0.0.204, which allows attackers to access internal networks. The vulnerability is present in the crawl endpoint where the 'url' parameter can be manipulated to send HTTP requests to arbitrary URLs, thereby facilitating SSRF attacks. The affected code is located in the backend/routes/crawl_routes.py file, specifically within the crawl_endpoint function. This issue could allow attackers to interact with internal services that are accessible from the server hosting the application.

Database specific 
{
    "cna_assigner": "@huntr_ai",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/4xxx/CVE-2024-4851.json"
}
References

Affected packages

Git / github.com/The-Vibe-Company/quivr

Affected ranges

Type
GIT
Repo
https://github.com/The-Vibe-Company/quivr
Events
Introduced
f9278da616045ea72ae9b4d6370e44f4a7435cb1
Last Affected
f9278da616045ea72ae9b4d6370e44f4a7435cb1
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:quivr:quivr:0.0.204:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0.0.204"
        },
        {
            "last_affected": "0.0.204"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

0.*
0.0.204
v0.*
v0.0.204

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-4851.json"