PYSEC-2024-256
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/mobsf/PYSEC-2024-256.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2024-256
- Aliases
- Published
- 2024-12-03T16:15:24Z
- Modified
- 2025-06-27T18:14:49.203947Z
- Summary
- [none]
- Details
-
Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In versions prior to 3.9.7, the requests.get() request in the checkurl method is specified as allow_redirects=True, which allows a server-side request forgery when a request to .well-known/assetlinks.json" returns a 302 redirect. This is a bypass of the fix for CVE-2024-29190 and is fixed in 3.9.7.
- References
Affected packages
PyPI / mobsf
Package
- Name
- mobsf
- View open source insights on deps.dev
- Purl
- pkg:pypi/mobsf