CVE-2024-39954

Description

CWE-918 Server-Side Request Forgery (SSRF) in eventmesh-runtime module in WebhookUtil.java on windowslinuxmac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources.Users are recommended to upgrade to version 1.12.0 or use the master branch , which fixes this issue.

Risk Information

Base Score

6.3

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

EPSS Score

Exploitation Probability

0.114

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2024-39954 are affected in Apache - eventmesh-runtime 1.11.0	Windows
Vulnerabilities CVE-2024-39954 are affected in Apache - eventmesh-runtime for Linux 1.11.0	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234