What is GHSA-g44m-hpf4-vmrp?

GHSA-g44m-hpf4-vmrp is a security advisory published by GitHub Security Advisories with High severity. FastChat Server-Side Request Forgery vulnerability

Which CVE IDs does GHSA-g44m-hpf4-vmrp cover?

GHSA-g44m-hpf4-vmrp covers the following CVE IDs: CVE-2024-12376. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-g44m-hpf4-vmrp?

GHSA-g44m-hpf4-vmrp has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-g44m-hpf4-vmrp?

GHSA-g44m-hpf4-vmrp affects 1 product, including: pip/fschat:\u003c= 0.2.36.

GHSA-g44m-hpf4-vmrpHighCVSS 7.5

FastChat Server-Side Request Forgery vulnerability

Vendor

GitHub Security Advisories

Published

March 20, 2025

Last Modified

March 21, 2025

🔗 CVE IDs covered (1)

CVE-2024-12376 →

📋 Description

A Server-Side Request Forgery (SSRF) vulnerability was identified in the lm-sys/fastchat web server, specifically in the affected version git 2c68a13. This vulnerability allows an attacker to access internal server resources and data that are otherwise inaccessible, such as AWS metadata credentials.

🎯 Affected products1

pip/fschat:<= 0.2.36

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2024-12376
https://huntr.com/bounties/c9cc3f28-ee9f-4d2d-9ee5-8c6455a11892
https://github.com/advisories/GHSA-g44m-hpf4-vmrp