CVSS 3.1
4.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NCVE-2024-31215
Medium (4.3) in opensecurity mobile security framework. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in mobsf 3.9.8.
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile.
A SSRF vulnerability in firebase database check logic. The attacker can cause the server to make a connection to internal-only services within the organization’s infrastructure. When a malicious app is uploaded to Static analyzer, it is possible to make internal requests. This vulnerability has been patched in version 3.9.8.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-10-31)
- CWE
- CWE-918
- Published
- Modified
- Record from
- the NVD, synced
Affected
- opensecurity:mobile_security_framework
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-wpff-wm84-x5cx | PyPI | mobsf | <3.9.8 | 3.9.8 |
| PYSEC-2026-1676 | PyPI | mobsf | <3.9.8 | 3.9.8 |
References
- https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/43bb71d115d78c03faa82d75445dd908e9b32716
- https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2373
- https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-wpff-wm84-x5cx
- https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/43bb71d115d78c03faa82d75445dd908e9b32716
- https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2373