CVE-2024-36471 Apache Allura: sensitive information exposure via DNS rebinding

2024-06-1021:55:06

CWE-918

CWE-20

CWE-200

apache

www.cve.org

apache allura

sensitive information exposure

dns rebinding

cve-2024-36471

upgrade

configuration file

EPSS

Percentile

9.0%

JSON

Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL. Project administrators can run these imports, which could cause Allura to read from internal services and expose them.

This issue affects Apache Allura from 1.0.1 through 1.16.0.

Users are recommended to upgrade to version 1.17.0, which fixes the issue. If you are unable to upgrade, set “disable_entry_points.allura.importers = forge-tracker, forge-discussion” in your .ini config file.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Allura",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "1.16.0",
        "status": "affected",
        "version": "1.0.1",
        "versionType": "semver"
      }
    ]
  }
]

References

lists.apache.org/thread/g43164t4bcp0tjwt4opxyks4svm8kvbh

EPSS

Percentile

9.0%

JSON

Related for CVELIST:CVE-2024-36471