PT-2024-22435 · Twenty · Twenty

Bruno Menna · Published 2024-03-25 · Updated 2024-08-26 · CVE-2024-28435

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Twenty version 0.3.0

Description The CRM platform is vulnerable to server-side request forgery (SSRF) via file upload. This issue allows an attacker to potentially access internal resources or make unauthorized requests.

Recommendations For version 0.3.0, consider disabling the file upload feature until a patch is available to prevent exploitation of the SSRF vulnerability. Restrict access to sensitive internal resources to minimize the risk of unauthorized access.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-28435

Affected Products

Twenty

References · 8

• 🔥 https://github.com/b-hermes/vulnerability-research/tree/main/CVE-2024-28435 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-28435 · Security Note
• https://osv.dev/vulnerability/CVE-2024-28435 · Vendor Advisory
• https://github.com/twentyhq/twenty · Note
• https://twitter.com/RedPacketSec/status/1772928430583009416 · Twitter Post
• https://twitter.com/CVEnew/status/1772265770581393807 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1772303841381224731 · Twitter Post
• https://t.me/cvenotify/92174 · Telegram Post