{"metadata": {"vulnerability": "cve-2024-6587", "count": 31, "kinds": {"milestone": 7, "sighting": 7, "kev": 6, "other": 11}}, "data": [{"timestamp": "2024-07-08T21:33:48.001Z", "date_only": false, "value": "2024-07-08T21:33:48.001Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2024-6587", "field": "cveMetadata.dateReserved"}, {"timestamp": "2024-08-22T07:14:14Z", "date_only": false, "value": "2024-08-22T07:14:14+00:00", "kind": "kev", "label": "Asserted", "source": "shadowserver", "record": "CVE-2024-6587", "field": "timestamps.asserted_at", "uuid": "2ff0e572-624c-46f3-b07b-20db088c970f", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2024-08-22T07:14:14Z", "date_only": false, "value": "2024-08-22T07:14:14+00:00", "kind": "kev", "label": "First seen", "source": "shadowserver", "record": "CVE-2024-6587", "field": "timestamps.first_seen_at", "uuid": "2ff0e572-624c-46f3-b07b-20db088c970f", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2024-09-13T15:59:53.557Z", "date_only": false, "value": "2024-09-13T15:59:53.557Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2024-6587", "field": "cveMetadata.datePublished"}, {"timestamp": "2024-09-13T15:59:53.557Z", "date_only": false, "value": "2024-09-13T15:59:53.557Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / @huntr_ai", "record": "cve-2024-6587", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2024-09-13T16:15:04Z", "date_only": false, "value": "2024-09-13T16:15:04Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-G26J-5385-HHW3", "record": "GHSA-G26J-5385-HHW3", "field": "database_specific.nvd_published_at"}, {"timestamp": "2024-09-13T16:15:04.637Z", "date_only": false, "value": "2024-09-13T16:15:04.637", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-6587", "record": "FKIE_CVE-2024-6587", "field": "published"}, {"timestamp": "2024-09-13T16:52:13.638Z", "date_only": false, "value": "2024-09-13T16:52:13.638830Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2024-6587", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2024-09-13T16:52:13.638Z", "date_only": false, "value": "2024-09-13T16:52:13.638830Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-6587", "record": "FKIE_CVE-2024-6587", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2024-09-13T16:53:11.849Z", "date_only": false, "value": "2024-09-13T16:53:11.849Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2024-6587", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2024-09-13T16:53:11.849Z", "date_only": false, "value": "2024-09-13T16:53:11.849Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2024-6587", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-09-13T18:31:47Z", "date_only": false, "value": "2024-09-13T18:31:47Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-G26J-5385-HHW3", "record": "GHSA-G26J-5385-HHW3", "field": "published"}, {"timestamp": "2024-09-13T18:48:15Z", "date_only": false, "value": "2024-09-13T18:48:15.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cvedetector/5622", "record": "CVE-2024-6587", "field": "creation_timestamp", "uuid": "db456759-5c2e-4ebc-a3ca-bcbe67ff8168", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-6587 - OpenAI Littelm API SSRF Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-6587 \nPublished : Sept. 13, 2024, 4:15 p.m. | 29\u00a0minutes ago \nDescription : A Server-Side Request Forgery (SSRF) vulnerability exists in berriai/litellm version 1.38.10. This vulnerability allows users to specify the `api_base` parameter when making requests to `POST /chat/completions`, causing the application to send the request to the domain specified by `api_base`. This request includes the OpenAI API key. A malicious user can set the `api_base` to their own domain and intercept the OpenAI API key, leading to unauthorized access and potential misuse of the API key. \nSeverity: 7.5 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"13 Sep 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "url": "https://t.me/cvedetector/5622"}, {"timestamp": "2024-09-13T19:29:08Z", "date_only": false, "value": "2024-09-13T19:29:08Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-G26J-5385-HHW3", "record": "GHSA-G26J-5385-HHW3", "field": "modified"}, {"timestamp": "2025-03-09T00:00:00Z", "date_only": false, "value": "2025-03-09T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-03-09)", "record": "CVE-2024-6587", "field": "creation_timestamp", "uuid": "29405ef6-8d40-4ccd-bd48-9aca6957179e"}, {"timestamp": "2025-03-14T15:30:06Z", "date_only": false, "value": "2025-03-14T15:30:06.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/6843", "record": "CVE-2024-6587", "field": "creation_timestamp", "uuid": "4e49d1d3-541b-46d5-ab22-71c5c6a199a3", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 GreyNoise \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u044e\u0442 \u043e\u0431 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0441\u043a\u043e\u043e\u0440\u0434\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u043c\u0430\u0441\u0441\u043e\u0432\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u043f\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 SSRF, \u043e\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c.\n\n\u0410\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0441\u0442\u0430\u0440\u0442\u043e\u0432\u0430\u043b\u0430 9 \u043c\u0430\u0440\u0442\u0430, \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0433\u0440\u0443\u043f\u043f\u0430 \u0438\u0437 400 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432.\n\n\u0410\u0442\u0430\u043a\u0438 \u0431\u044b\u043b\u0438 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u044b \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u0438 SSRF \u0432 Zimbra, GitLab, DotNetNuke, VMware, ColumbiaSoft, Ivanti, BerriAI \u0438 OpenBMCS \u0438 \u043c\u043d\u043e\u0433\u0438\u0445 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\u0445.\n\n\u0411\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0430\u0442\u0430\u043a \u0431\u044b\u043b\u0438 \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b \u043d\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u0421\u0428\u0410, \u0413\u0435\u0440\u043c\u0430\u043d\u0438\u0438, \u0418\u043d\u0434\u0438\u0438, \u042f\u043f\u043e\u043d\u0438\u0438 \u0438 \u0421\u0438\u043d\u0433\u0430\u043f\u0443\u0440\u0435, \u043d\u043e \u043d\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435 \u043e\u0441\u043e\u0431\u043e\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c\u0438 \u0431\u044b\u043b\u043e \u0443\u0434\u0435\u043b\u0435\u043d\u043e \u0418\u0437\u0440\u0430\u0438\u043b\u044e \u0438 \u041d\u0438\u0434\u0435\u0440\u043b\u0430\u043d\u0434\u0430\u043c.\n\n\u0412 \u0447\u0438\u0441\u043b\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 SSRF: \n- CVE-2017-0929\u00a0(CVSS: 7,5, DotNetNuke), \n- CVE-2020-7796\u00a0(CVSS: 9,8, Zimbra Collaboration Suite, \n- CVE-2021-21973\u00a0(CVSS: 5,3, VMware vCenter, \n- CVE-2021-22054\u00a0(CVSS: 7,5, VMware Workspace ONE UEM), \n- CVE-2021-22175\u00a0(CVSS: 9,8, GitLab CE/EE, \n- CVE-2021-22214\u00a0(CVSS: 8,6) \u0438 CVE-2021-39935\u00a0(CVSS: 7,5, GitLab CE/EE), \n- CVE-2023-5830\u00a0(CVSS: 9,8, ColumbiaSoft DocumentLocator), \n- CVE-2024-6587\u00a0(CVSS: 7,5, BerriAI LiteLLM), \n- CVE-2024-21893\u00a0(CVSS: 8,2, Ivanti Connect Secure),\n- OpenBMCS 2.4\u00a0\u0438 Zimbra Collaboration Suite\u00a0(\u0431\u0435\u0437 CVE).\n\n\u041a\u0430\u043a \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442 GreyNoise, \u043c\u043d\u043e\u0433\u0438\u0435 \u0438\u0437 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u044b \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u043d\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 SSRF, \u043e\u0442\u043c\u0435\u0447\u0430\u044f, \u0447\u0442\u043e \u0448\u0430\u0431\u043b\u043e\u043d \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0435\u043c\u043e\u0439  \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e, \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u044e \u0438\u043b\u0438 \u0441\u0431\u043e\u0440 \u0440\u0430\u0437\u0432\u0435\u0434\u044b\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043f\u0435\u0440\u0435\u0434 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0435\u0439.\n\n\u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 SSRF \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0442\u044c \u043a\u0430\u0440\u0442\u044b \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0445 \u0441\u0435\u0442\u0435\u0439, \u0432\u044b\u044f\u0432\u043b\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u0438 \u043a\u0440\u0430\u0441\u0442\u044c \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0434\u043b\u044f \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432.\n\nGreyNoise \u043e\u0442\u043c\u0435\u0442\u0438\u043b\u0430, \u0447\u0442\u043e \u0442\u0430\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u044b\u0433\u0440\u0430\u043b\u0438 \u0432\u0430\u0436\u043d\u0443\u044e \u0440\u043e\u043b\u044c \u0432\u00a0\u0443\u0442\u0435\u0447\u043a\u0435 Capital One\u00a0\u0432 2019 \u0433\u043e\u0434\u0443, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0430 \u0431\u043e\u043b\u0435\u0435 100 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439.\n\n\u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u043c\u0438 \u043f\u043e\u043f\u044b\u0442\u043a\u0430\u043c\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043a\u0440\u0430\u0439\u043d\u0435 \u0432\u0430\u0436\u043d\u043e \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f, \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0438\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u043c\u0438 \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u043c\u0438 \u0442\u043e\u0447\u043a\u0430\u043c\u0438 \u0438 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0438\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u044b.", "url": "https://t.me/true_secator/6843"}, {"timestamp": "2026-06-17T08:18:17.787Z", "date_only": false, "value": "2026-06-17T08:18:17.787", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-6587", "record": "FKIE_CVE-2024-6587", "field": "lastModified"}, {"timestamp": "2026-06-23T14:06:09.475Z", "date_only": false, "value": "2026-06-23T14:06:09.475151Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/58fd9c3c-4ecb-462d-a946-7f6a7de446e9", "record": "CVE-2024-6587", "field": "creation_timestamp", "uuid": "bd2fed8c-21d4-496d-9850-a50261efefac", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/58fd9c3c-4ecb-462d-a946-7f6a7de446e9"}, {"timestamp": "2026-06-27T10:15:11.122Z", "date_only": false, "value": "2026-06-27T10:15:11.122634Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-06-26)", "record": "CVE-2024-6587", "field": "creation_timestamp", "uuid": "3367208a-ae69-45b9-ab04-537b5056075c"}, {"timestamp": "2026-06-30T09:23:12.008Z", "date_only": false, "value": "2026-06-30T09:23:12.008852Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ce3bfd59-5fcb-4339-a375-dc93f3ba1223", "record": "CVE-2024-6587", "field": "creation_timestamp", "uuid": "84609411-50ff-440c-9062-effcc97465bf", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ce3bfd59-5fcb-4339-a375-dc93f3ba1223"}, {"timestamp": "2026-07-01T07:17:37.453Z", "date_only": false, "value": "2026-07-01T07:17:37.453008Z", "kind": "sighting", "label": "Exploited", "source": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/2ff0e572-624c-46f3-b07b-20db088c970f", "record": "CVE-2024-6587", "field": "creation_timestamp", "uuid": "9f083381-aaa7-4676-bf46-800c6b3f890c", "url": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/2ff0e572-624c-46f3-b07b-20db088c970f"}, {"timestamp": "2026-07-07T14:34:40.863Z", "date_only": false, "value": "2026-07-07T14:34:40.863022Z", "kind": "milestone", "label": "Published", "source": "pysec \u00b7 PYSEC-2026-1547", "record": "PYSEC-2026-1547", "field": "published"}, {"timestamp": "2026-07-07T17:24:31.669Z", "date_only": false, "value": "2026-07-07T17:24:31.669536Z", "kind": "other", "label": "Updated", "source": "pysec \u00b7 PYSEC-2026-1547", "record": "PYSEC-2026-1547", "field": "modified"}, {"timestamp": "2026-08-13T16:35:12Z", "date_only": false, "value": "2026-08-13T16:35:12Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-AIDER-CVE-2024-6587", "record": "BREW-AIDER-CVE-2024-6587", "field": "published"}, {"timestamp": "2026-08-13T17:32:08Z", "date_only": false, "value": "2026-08-13T17:32:08Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-RAWDOG-CVE-2024-6587", "record": "BREW-RAWDOG-CVE-2024-6587", "field": "published"}, {"timestamp": "2026-09-06T00:00:00Z", "date_only": false, "value": "2026-09-06T00:00:00+00:00", "kind": "kev", "label": "Last seen", "source": "shadowserver", "record": "CVE-2024-6587", "field": "timestamps.last_seen_at", "uuid": "2ff0e572-624c-46f3-b07b-20db088c970f", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-06T00:00:00Z", "date_only": true, "value": "2026-09-06", "kind": "kev", "label": "Observation date", "source": "shadowserver", "record": "CVE-2024-6587", "field": "evidence.0.details.observation_date", "uuid": "2ff0e572-624c-46f3-b07b-20db088c970f", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-06T00:00:00Z", "date_only": false, "value": "2026-09-06T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "shadowserver", "record": "CVE-2024-6587", "field": "status.status_updated_at", "uuid": "2ff0e572-624c-46f3-b07b-20db088c970f", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-08T01:00:01Z", "date_only": false, "value": "2026-09-08T01:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "shadowserver", "record": "CVE-2024-6587", "field": "timestamps.recorded_at", "uuid": "2ff0e572-624c-46f3-b07b-20db088c970f", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-17T19:11:20Z", "date_only": false, "value": "2026-09-17T19:11:20Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-AIDER-CVE-2024-6587", "record": "BREW-AIDER-CVE-2024-6587", "field": "modified"}, {"timestamp": "2026-10-13T09:11:27Z", "date_only": false, "value": "2026-10-13T09:11:27Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-RAWDOG-CVE-2024-6587", "record": "BREW-RAWDOG-CVE-2024-6587", "field": "modified"}]}