CVE-2024-9308

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An open redirect vulnerability in haotian-liu/llava version v1.2.0 (LLaVA-1.6) allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This can be exploited for phishing attacks, malware distribution, and credential theft.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
haotian-liu	haotian-liu/llava	>= unspecified, <= latest

References

https://huntr.com/bounties/6233a165-a435-464d-915c-4c7510ffbf82Exploit, Third Party Advisory

Timeline

Published: Mar 20, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-93099.3A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Controller API Server in h CVE-2024-93106.0By utilizing software-defined radios and a custom low-latency processing pipeline, RF signals with spoofed location data can be transmitted CVE-2024-93116.1A Cross-Site Request Forgery (CSRF) vulnerability in haotian-liu/llava v1.2.0 (LLaVA-1.6) allows an attacker to upload files with malicious CVE-2024-93126.4Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names co CVE-2024-93138.8Authd PAM module before version 0.3.5 can allow broker-managed users to impersonate any other user managed by the same broker and perform an CVE-2024-93147.2The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, CVE-2024-93158.8A vulnerability was found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. It has been rated as critical. This issue aff CVE-2024-93167.5A vulnerability classified as critical has been found in code-projects Blood Bank Management System 1.0. Affected is an unknown function of CVE-2024-93178.8A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerability is the function d CVE-2024-93189.8A vulnerability, which was classified as critical, has been found in SourceCodester Advocate Office Management System 1.0. Affected by this CVE-2024-93198.8A vulnerability, which was classified as critical, was found in SourceCodester Online Timesheet App 1.0. This affects an unknown part of the CVE-2024-93205.4A vulnerability has been found in SourceCodester Online Timesheet App 1.0 and classified as problematic. This vulnerability affects unknown