CVE-2024-39954

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-39954
CWE-918 Server-Side Request Forgery (SSRF) in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources. Users are recommended to upgrade to version 1.12.0 or use the master branch , which fixes this issue.

6.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://lists.apache.org/thread/v6c96zygqx8xc2k3n2d59mgnm5txhkon Mailing List
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:eventmesh:*:*:*:*:*:*:*:*
History

21 Aug 2025, 18:25

Type Values Removed Values Added
CPE cpe:2.3:a:apache:eventmesh:*:*:*:*:*:*:*:*
First Time Apache
Apache eventmesh
References () https://lists.apache.org/thread/v6c96zygqx8xc2k3n2d59mgnm5txhkon - () https://lists.apache.org/thread/v6c96zygqx8xc2k3n2d59mgnm5txhkon - Mailing List

20 Aug 2025, 14:15

Type Values Removed Values Added
Summary
  • (es) CWE-918 Server-Side Request Forgery (SSRF) en eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g., permite al atacante abusar de la funcionalidad del servidor para leer o actualizar recursos internos. Se recomienda a los usuarios actualizar a la versión 1.12.0 o usar la rama master, que soluciona este problema.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.3

20 Aug 2025, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-20 09:15

Updated : 2025-08-21 18:25

NVD link : CVE-2024-39954

Mitre link : CVE-2024-39954

CVE.ORG link : CVE-2024-39954

JSON object : View

Products Affected

apache

  • eventmesh
CWE
CWE-918

Server-Side Request Forgery (SSRF)