CVE-2024-2057

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-2057
A vulnerability was found in LangChain langchain_community 0.0.26. It has been classified as critical. Affected is the function load_local in the library libs/community/langchain_community/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.0.27 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-255372.

6.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

6.5 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://github.com/bayuncao/vul-cve-16
https://github.com/bayuncao/vul-cve-16/tree/main/PoC.pkl
https://github.com/langchain-ai/langchain/pull/18695
https://vuldb.com/?ctiid.255372
https://vuldb.com/?id.255372
Configurations

No configuration.

History

13 Mar 2024, 16:15

Type Values Removed Values Added
Summary (en) A vulnerability was found in Harrison Chase LangChain 0.1.9. It has been classified as critical. Affected is the function load_local in the library libs/community/langchain_community/retrievers/tfidf.py. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-255372. (en) A vulnerability was found in LangChain langchain_community 0.0.26. It has been classified as critical. Affected is the function load_local in the library libs/community/langchain_community/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.0.27 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-255372.

10 Mar 2024, 02:16

Type Values Removed Values Added
References
  • () https://github.com/langchain-ai/langchain/pull/18695 -
Summary
  • (es) Se encontró una vulnerabilidad en Harrison Chase LangChain 0.1.9. Ha sido clasificada como crítica. La función load_local en la librería libs/community/langchain_community/retrievers/tfidf.py es afectada por la vulnerabilidad. La manipulación conduce a Server-Side Request Forgery. Es posible lanzar el ataque de forma remota. El exploit ha sido divulgado al público y puede utilizarse. El identificador de esta vulnerabilidad es VDB-255372.

01 Mar 2024, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-01 12:15

Updated : 2024-04-11 01:25

NVD link : CVE-2024-2057

Mitre link : CVE-2024-2057

CVE.ORG link : CVE-2024-2057

JSON object : View

Products Affected

No product.

CWE
CWE-918

Server-Side Request Forgery (SSRF)