CVE-2024-45843CWE-918

Weak SSRF Filtering

Low · published September 26, 2024

CVSS v3.1
3.1
EPSS
0%
Percentile
11.3
In the wild
Unconfirmed
What it is

Mattermost versions 9.5.x <= 9.5.8 fail to include the metadata endpoints of Oracle Cloud and Alibaba in the SSRF denylist, which allows an attacker to possibly cause an SSRF if Mattermost was deployed in Oracle Cloud or Alibaba.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00215 · 11.3th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2024-09-26T08:03Z
EPSS history
Timeline
  • 26 SEP 08:03Z
    Weak SSRF Filtering
    cvelistv5