根據其標題，遠端主機上執行的 BentoML 版本為低於 1.4.8 的 1.4.x。因此，它受到檔案上傳處理中的伺服器端要求偽造 (SSRF) 弱點的影響。

請注意，掃描器程式並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

根据其标题，远程主机上运行的 BentoML 版本为低于 1.4.8 的 1.4.x。因此，它受到文件上传处理中服务器端请求伪造 (SSRF) 漏洞的影响。

请注意，扫描程序并未测试这些问题，而是仅依据应用程序自我报告的版本号进行判断。

バナーによると、リモートホストで実行中の BentoML のバージョンは、1.4.x < 1.4.8 です。したがって、ファイルアップロード処理におけるサーバーサイドリクエストフォージェリ (SSRF) の脆弱性の影響を受けます。

スキャナーはこれらの問題のテストを行っておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

According to its banner, the version of BentoML running on the remote host is 1.4.x < 1.4.8. It is, therefore, affected by a Server-Side Request Forgery (SSRF) vulnerability in File Upload Processing.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - BentoML is a Python library for building online serving systems optimized for AI apps and model inference.
    In versions 1.4.0 until 1.4.19, the file upload processing system contains an SSRF vulnerability that
    allows unauthenticated remote attackers to force the server to make arbitrary HTTP requests. The
    vulnerability stems from the multipart form data and JSON request handlers, which automatically download
    files from user-provided URLs without validating whether those URLs point to internal network addresses,
    cloud metadata endpoints, or other restricted resources. The documentation explicitly promotes this URL-
    based file upload feature, making it an intended design that exposes all deployed services to SSRF attacks
    by default. Version 1.4.19 contains a patch for the issue. (CVE-2025-54381)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
114932	BentoML 1.4.x < 1.4.19 伺服器端請求偽造	Web App Scanning	Artificial Intelligence	2025/8/5	2025/8/5	critical
114932	BentoML 1.4.x < 1.4.19 服务器端请求伪造	Web App Scanning	Artificial Intelligence	2025/8/5	2025/8/5	critical
114932	BentoML 1.4.x < 1.4.19 サーバーサイドリクエスト偽造	Web App Scanning	Artificial Intelligence	2025/8/5	2025/8/5	critical
114932	BentoML 1.4.x < 1.4.19 Server-Side Request Forgery	Web App Scanning	Artificial Intelligence	2025/8/5	2025/8/5	critical
428673	SCA: security update for bentoml (GHSA-mrmq-3q62-6cc8)	Tenable Cloud Security	SCA Checks	2025/7/30	2026/7/2	critical
428673	SCA: security update for bentoml (GHSA-mrmq-3q62-6cc8)	Tenable Self-Hosted Container Security	SCA Checks	2025/7/30	2026/7/2	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical