CVE-2024-12236

CVSS V2 None CVSS V3 None
Description
A security issue exists in Vertex Gemini API for customers using VPC-SC. By utilizing a custom crafted file URI for image input, data exfiltration is possible due to requests being routed outside the VPC-SC security perimeter, circumventing the intended security restrictions of VPC-SC. No further fix actions are needed. Google Cloud Platform implemented a fix to return an error message when a media file URL is specified in the fileUri parameter and VPC Service Controls is enabled. Other use cases are unaffected.
Overview
  • CVE ID
  • CVE-2024-12236
  • Assigner
  • Google
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2024-12-10T15:07:40.230Z
  • Last Modified Date
  • 2024-12-10T15:07:40.230Z
Weakness Enumerations
CWE URL
CWE-755 http://cwe.mitre.org/data/definitions/755.html
References
Reference URL Reference Tags
https://cloud.google.com/vertex-ai/generative-ai/docs/security-bulletins#gcp-2024-063
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2024-12236
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-12236
History
Created Old Value New Value Data Type Notes
2024-12-11 13:27:50 Added to TrackCVE