CVE-2024-36471highCWE-20CWE-200CWE-918

CVE-2024-36471: fallo de gravedad alta en Apache Allura

Apache Allura: sensitive information exposure via DNS rebinding

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Apache Allura

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 0.8%
Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL.  Project administrators can run these imports, which could cause Allura to read from internal services and expose them. This issue affects Apache Allura from 1.0.1 through 1.16.0. Users are recommended to upgrade to version 1.17.0, which fixes the issue. If you are unable to upgrade, set "disable_entry_points.allura.importers = forge-tracker, forge-discussion" in your .ini config file.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
Apache Software Foundation · Apache Allura
CVEs relacionadas — Apache Allura

En el mismo producto, de las más peligrosas a las menos.

CVE-2018-1299—CVE-2018-1299EPSS 3.0%CVE-2023-46851—Apache Allura: sensitive information exposure via importEPSS 2.2%CVE-2018-1319—CVE-2018-1319EPSS 2.2%CVE-2026-73240CRITICALApache Allura: Git command injectionEPSS 1.0%CVE-2026-73237MEDIUMApache Allura: XSS in markdown pipelineEPSS 0.8%CVE-2026-73238MEDIUMApache Allura: XSS in code displayEPSS 0.8%