UpHeron
All vulnerabilities

Servers and applications

CVE-2024-12775

langgenius/dify version 0.10.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the test functionality for the Create Custom Tool option via the REST API `POST /console/api/workspaces/current/tool-provider/api/test/pre`. Attackers can set the `url` in the `servers` dictionary in OpenAI's schema with arbitrary URL targets, allowing them to abuse the victim server's credentials to…

Severity
Medium 6.5
Published
20 Mar 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
DifyServers and applications · cpe:a:langgenius:dify
  • Version 0.10.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-12775
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-12775