CyberRota Analysis
AI-GeneratedThe vulnerability in the get_images function of the mcp-florence2 library allows for server-side request forgery (SSRF), which can be exploited remotely. This could lead to unauthorized access to internal resources or sensitive data. Organizations using versions up to 0.3.13 of this library should prioritize applying configuration changes or implementing an SSRF-safe proxy to mitigate the risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw has been found in jkawamoto mcp-florence2 up to 0.3.13. Affected by this issue is the function get_images of the file src/mcp_florence2/__init__.py. This manipulation of the argument src causes server-side request forgery. The attack may be initiated remotely. The exploit has been published and may be used. It is recommended to change the configuration settings. The vendor explains: "For deployments where SSRF protection is required, I recommend routing all HTTP(S) requests through an SSRF-safe proxy server. This approach mitigates the vulnerability without requiring changes to the mcp-florence2 source code."