PT-2024-32472 · Mender · Hosted Mender

Ole Herman S. Elgesem · Published 2024-11-08 · Updated 2024-11-08 · CVE-2024-47190

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hosted Mender versions prior to 2024.07.11

Description The issue is related to a Server-Side Request Forgery (SSRF) vulnerability. This allows an attacker to forge requests from the server to other services, potentially leading to unauthorized access or data exposure. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations For versions prior to 2024.07.11, update to a version 2024.07.11 or later to resolve the SSRF vulnerability. As a temporary workaround, consider restricting access to sensitive services and resources that could be targeted by SSRF attacks until the update is applied.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-47190

Affected Products

Hosted Mender

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-47190 · Security Note
• https://mender.io/blog/cve-2024-46947-cve-2024-47190-ssrf-issues-in-mender-enterprise-server · Note
• https://twitter.com/VulmonFeeds/status/1854998138475479542 · Twitter Post
• https://t.me/cvedetector/10202 · Telegram Post
• https://twitter.com/CVEnew/status/1854914630226677863 · Twitter Post