HIGH🇵🇱 Wersja polska

CVE-2024-12882

CVSS 7.5v3.0pub. 2025-03-20upd. 2025-08-01

comfyanonymous/comfyui version v0.2.4 suffers from a non-blind Server-Side Request Forgery (SSRF) vulnerability. This vulnerability can be exploited by combining the REST APIs `POST /internal/models/download` and `GET /view`, allowing attackers to abuse the victim server's credentials to access unauthorized web resources.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

  • Comfy Comfyui

    APP
    Comfy
    0.2.4
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
SSRF
CWE
References

Related vulnerabilities

CVE-2024-10481MEDIUM6.5ten sam produkt

A CSRF vulnerability exists in comfyanonymous/comfyui versions up to v0.2.2. This vulnerability allows attacke...

CVE-2024-10099MEDIUM6.1ten sam produkt

A stored cross-site scripting (XSS) vulnerability exists in comfyanonymous/comfyui version 0.2.2 and possibly ...

CVE-2026-22777HIGH7.5ten sam vendor

ComfyUI-Manager is an extension designed to enhance the usability of ComfyUI. Prior to versions 3.39.2 and 4.0...

CVE-2025-67303HIGH7.5ten sam vendor

An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its confi...