CVE-2024-5885 - CVE House
Back to Database
Status published High CVE-2024-5885

Server-Side Request Forgery (SSRF) in stangirard/quivr

Vulnerability Description

stangirard/quivr version 0.0.236 contains a Server-Side Request Forgery (SSRF) vulnerability. The application does not provide sufficient controls when crawling a website, allowing an attacker to access applications on the local network. This vulnerability could allow a malicious user to gain access to internal servers, the AWS metadata endpoint, and capture Supabase data.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-5885

Credits & Attribution

No credits recorded in the NVD database.

References

More from stangirard

View All →
CVE-2024-9229
Denial of Service (DoS) via Multipart Boundary in stangirard/quivr
High 7.5
CVE-2024-6583
Path Traversal in stangirard/quivr
Medium 4.3
CVE-2024-6229
Stored XSS in stangirard/quivr
Medium 6.8
CVE-2024-4851
SSRF Vulnerability in stangirard/quivr
High 7.7

Affected Vendor

Affected Software

stangirard/quivr
Vulnerable Versions:
unspecified

Timeline

Official Publish: June 27th, 2024
Last Modified: August 1st, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weaknesses (CWE)

CWE-918

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1046 Network Service Discovery
Discovery