CVE-2024-31215: falha de média gravidade em MobSF Mobile-Security-Framework-MobSF
Mobile Security Framework (MobSF) vulnerable to Server-Side Request Forgery (SSRF) in firebase database check
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.3epss 0.5%
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile.
A SSRF vulnerability in firebase database check logic. The attacker can cause the server to make a connection to internal-only services within the organization’s infrastructure. When a malicious app is uploaded to Static analyzer, it is possible to make internal requests. This vulnerability has been patched in version 3.9.8.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Produtos afetados
MobSF · Mobile-Security-Framework-MobSFCVEs relacionadas — MobSF Mobile-Security-Framework-MobSF
No mesmo produto, das mais perigosas para as menos.
CVE-2024-41955MEDIUMMobile Security Framework (MobSF) has an Open Redirect in Login RedirectEPSS 1.0%CVE-2024-43399HIGHMobile Security Framework (MobSF) has a Zip Slip Vulnerability in .a Static Library FilesEPSS 1.0%CVE-2025-58161LOWMobSF Path Traversal in GET /download/<filename> using absolute filenamesEPSS 0.8%CVE-2024-29190HIGHMobSF SSRF Vulnerability on assetlinks_check(act_name, well_knowns)EPSS 0.7%CVE-2025-58162MEDIUMMobSF Vulnerable to Arbitrary File Write (AR-Slip) via Absolute Path in .a ExtractionEPSS 0.6%CVE-2026-68924MEDIUMMobSF: Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK ExtractionEPSS 0.6%