CVE-2024-12882

SSRF in comfyanonymous/comfyui

Summary

Original description

The description as published by the source.

comfyanonymous/comfyui version v0.2.4 suffers from a non-blind Server-Side Request Forgery (SSRF) vulnerability. This vulnerability can be exploited by combining the REST APIs POST /internal/models/download and GET /view, allowing attackers to abuse the victim server's credentials to access unauthorized web resources.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

References

advisory github.com
advisory nvd.nist.gov
web huntr.com

Metadata

CVE: CVE-2024-12882
Published: 2025-03-20
First seen on SecPulse: 1 year ago
First-seen source: OSV.dev (Open Source Vulnerabilities)

CWE

CWE-918

Detection sources

OSV.dev (Open Source Vulnerabilities) 1 month ago