CVE-2024-39954 — Apache EventMesh Runtime: SSRF

CVE-2024-39954

Apache EventMesh Runtime: SSRF PUBLISHED

Description (CNA)

CWE-918 Server-Side Request Forgery (SSRF) in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources. Users are recommended to upgrade to version 1.12.0 or use the master branch , which fixes this issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache EventMesh Runtime	affected 1.6.0 through 1.11.0

CWE

CWE-918

References

https://lists.apache.org/thread/v6c96zygqx8xc2k3n2d59mgnm5txhkon

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.