What’s Vulnerable › Vulnerabilities

CVE-2024-36471: Apache Allura: sensitive information exposure via DNS rebinding

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-10 · updated 2026-06-17
• Weakness: CWE-20

Description

Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL.  Project administrators can run these imports, which could cause Allura to read from internal services and expose them. This issue affects Apache Allura from 1.0.1 through 1.16.0. Users are recommended to upgrade to version 1.17.0, which fixes the issue. If you are unable to upgrade, set "disable_entry_points.allura.importers = forge-tracker, forge-discussion" in your .ini config file.

Affected products

• Apache Software Foundation Apache Allura: from 1.0.1 before 1.17.0 — fixed in 1.17.0

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Allura 1.17.0. Check the vendor advisory for mitigations.

References

• https://lists.apache.org/thread/g43164t4bcp0tjwt4opxyks4svm8kvbh
• http://www.openwall.com/lists/oss-security/2024/06/10/1
• https://lists.apache.org/thread/g43164t4bcp0tjwt4opxyks4svm8kvbh

Get alerted when CVE-2024-36471 or the next vulnerability affects your stack