CVE-2024-12882 — SSRF in comfyanonymous/comfyui
comfyanonymous/comfyui version v0.2.4 suffers from a non-blind Server-Side Request Forgery (SSRF) vulnerability. This vulnerability can be exploited by combining the REST APIs `…
Published: 2025-03-20 · CVSS: 7.5 · CVSS 3.0
comfyanonymous/comfyui version v0.2.4 suffers from a non-blind Server-Side Request Forgery (SSRF) vulnerability. This vulnerability can be exploited by combining the REST APIs `POST /internal/models/download` and `GET /view`, allowing attackers to abuse the victim server's credentials to access unauthorized web resources.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7