CVE-2024-56180

Apache EventMesh is vulnerable to CWE-502 Deserialization of Untrusted Data within the eventmesh-meta-raft plugin module. This flaw affects the master branch (without release version) on Windows, Linux, and macOS platforms. An attacker can exploit this by sending controlled messages via the hessi...

CVE-2024-39954

The org.apache.eventmesh:eventmesh-runtime component is vulnerable to a Server-Side Request Forgery (SSRF) (CWE-918) within the WebhookUtil.java file. The root cause is the improper validation of user-supplied URLs due to unsafe handling in the module, which allows an attacker to send crafted req...