CVSS 3.1
6.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:LCVE-2024-39954
Medium (6.3) in apache eventmesh. EPSS 0.4% chance of exploitation in the next 30 days.
CWE-918 Server-Side Request Forgery (SSRF) in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources.
Users are recommended to upgrade to version 1.12.0 or use the master branch , which fixes this issue.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 34% of CVEs (scores of 2026-10-31)
- CWE
- CWE-918
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:eventmesh
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-hf86-8x8v-h7vc | Maven | org.apache.eventmesh:eventmesh-runtime | >=1.6.0-release <=1.11.0-release | no fix published |