VYPR
← All advisories
High severity7.5NVD Advisory· Published Jun 10, 2024· Updated Jun 17, 2026

CVE-2024-36471

CVE-2024-36471

Description

Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL.  Project administrators can run these imports, which could cause Allura to read from internal services and expose them.

This issue affects Apache Allura from 1.0.1 through 1.16.0.

Users are recommended to upgrade to version 1.17.0, which fixes the issue. If you are unable to upgrade, set "disable_entry_points.allura.importers = forge-tracker, forge-discussion" in your .ini config file.

Affected products

3
  • Apache/Allura2 versions
    cpe:2.3:a:apache:allura:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:apache:allura:*:*:*:*:*:*:*:*range: >=1.0.1,<1.17.0
    • (no CPE)range: 1.0.1 - 1.16.0
  • Apache Software Foundation/Apache Allurav5
    Range: 1.0.1

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.