7.5
Élevée
CVE-2024-6587 A Server-Side Request Forgery (SSRF) vulnerability exists in berriai/litellm version 1.38.10
Description
A Server-Side Request Forgery (SSRF) vulnerability exists in berriai/litellm version 1.38.10. This vulnerability allows users to specify the `api_base` parameter when making requests to `POST /chat/completions`, causing the application to send the request to the domain specified by `api_base`. This request includes the OpenAI API key. A malicious user can set the `api_base` to their own domain and intercept the OpenAI API key, leading to unauthorized access and potential misuse of the API key.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| berriai/litellm 1.44 | premières → < 1.44.9 | 1.44.9 |
| litellm 1.44 | premières → < 1.44.9 | 1.44.9 |
Références
- huntr.com huntr.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de berriai/litellm
Les 15 CVE de berriai/litellm →
CVE-2024-6825
BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution
8.8
Élevée
CVE-2024-10188
A vulnerability in BerriAI/litellm, as of commit 26c03c9, allows unauthenticated users to cause a Denial of Service…
7.5
Élevée
CVE-2025-0628
An improper authorization vulnerability exists in the main-latest version of BerriAI/litellm
8.1
Élevée
CVE-2025-0330
In berriai/litellm version v1.52.1, an issue in proxy_server.py causes the leakage of Langfuse API keys when an error…
7.5
Élevée