CVE-2024-36471highCWE-20CWE-200CWE-918

CVE-2024-36471: high-severity vulnerability in Apache Allura

Apache Allura: sensitive information exposure via DNS rebinding

Published · Updated

Follow this CVE+ Monitor Apache Allura

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.8%
Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL.  Project administrators can run these imports, which could cause Allura to read from internal services and expose them. This issue affects Apache Allura from 1.0.1 through 1.16.0. Users are recommended to upgrade to version 1.17.0, which fixes the issue. If you are unable to upgrade, set "disable_entry_points.allura.importers = forge-tracker, forge-discussion" in your .ini config file.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Apache Software Foundation · Apache Allura
Related CVEs — Apache Allura

In the same product, most dangerous first.

CVE-2018-1299—CVE-2018-1299EPSS 3.0%CVE-2023-46851—Apache Allura: sensitive information exposure via importEPSS 2.2%CVE-2018-1319—CVE-2018-1319EPSS 2.2%CVE-2026-73240CRITICALApache Allura: Git command injectionEPSS 1.0%CVE-2026-73237MEDIUMApache Allura: XSS in markdown pipelineEPSS 0.8%CVE-2026-73238MEDIUMApache Allura: XSS in code displayEPSS 0.8%