CVE-2024-36471highCWE-20CWE-200CWE-918

CVE-2024-36471: falha de alta gravidade em Apache Allura

Apache Allura: sensitive information exposure via DNS rebinding

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Apache Allura

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.8%
Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL.  Project administrators can run these imports, which could cause Allura to read from internal services and expose them. This issue affects Apache Allura from 1.0.1 through 1.16.0. Users are recommended to upgrade to version 1.17.0, which fixes the issue. If you are unable to upgrade, set "disable_entry_points.allura.importers = forge-tracker, forge-discussion" in your .ini config file.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
Apache Software Foundation · Apache Allura
CVEs relacionadas — Apache Allura

No mesmo produto, das mais perigosas para as menos.

CVE-2018-1299—CVE-2018-1299EPSS 3.0%CVE-2023-46851—Apache Allura: sensitive information exposure via importEPSS 2.2%CVE-2018-1319—CVE-2018-1319EPSS 2.2%CVE-2026-73240CRITICALApache Allura: Git command injectionEPSS 1.0%CVE-2026-73237MEDIUMApache Allura: XSS in markdown pipelineEPSS 0.8%CVE-2026-73238MEDIUMApache Allura: XSS in code displayEPSS 0.8%