CVE-2024-39954

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-39954
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-39954.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-39954
Aliases
Published
2025-08-20T08:56:41.560Z
Modified
2026-07-15T01:49:19.003132553Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CVSS Calculator
Summary
Apache EventMesh Runtime: SSRF
Details

CWE-918 Server-Side Request Forgery (SSRF) in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources. Users are recommended to upgrade to version 1.12.0 or use the master branch , which fixes this issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39954.json",
    "cwe_ids": [
        "CWE-918"
    ],
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.6.0"
                },
                {
                    "last_affected": "1.11.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "apache"
}
References

Affected packages

Git / github.com/apache/eventmesh

Affected ranges

Type
GIT
Repo
https://github.com/apache/eventmesh
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3982f70a8bd5adf2ef675ae3331ab5d72ba114bb
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.12.0"
        }
    ],
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:apache:eventmesh:*:*:*:*:*:*:*:*"
}

Affected versions

v1.*
v1.10.0
v1.10.0-rc1
v1.10.0-rc2
v1.12.0-rc1
v1.12.0-rc2
v1.6.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-39954.json"