PT-2024-33086 · Xtreme1 · Xtreme1

Shadia0O · Published 2024-10-30 · Updated 2024-11-01 · CVE-2024-48346

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions xtreme1 versions prior to 0.9.2

Description The issue is related to a Server-Side Request Forgery (SSRF) vulnerability. It is triggered through the fileUrl parameter in the "/api/data/upload" API endpoint, allowing an attacker to make arbitrary requests to internal or external systems.

Recommendations For versions prior to 0.9.2, as a temporary workaround, consider restricting access to the "/api/data/upload" API endpoint until a patch is available. Avoid using the fileUrl parameter in the affected API endpoint until the issue is resolved.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-48346

Affected Products

Xtreme1

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-48346 · Security Note
• https://osv.dev/vulnerability/CVE-2024-48346 · Vendor Advisory
• https://github.com/xtreme1-io/xtreme1/issues/284 · Note
• https://t.me/cvedetector/9466 · Telegram Post