CVE-2024-36471

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL.  Project administrators can run these imports, which could cause Allura to read from internal services and expose them.

This issue affects Apache Allura from 1.0.1 through 1.16.0.

Users are recommended to upgrade to version 1.17.0, which fixes the issue. If you are unable to upgrade, set "disable_entry_points.allura.importers = forge-tracker, forge-discussion" in your .ini config file.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-20CWE-200CWE-918

Affected software

VendorProductVersions
Apache Software FoundationApache Allura>= 1.0.1, <= 1.16.0
apacheallura>= 1.0.1, <= 1.16.0

References

Timeline

Published
Jun 10, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-364726.5In GNOME Shell through 45.7, a portal helper can be launched automatically (without user confirmation) based on network responses provided bCVE-2024-364735.3Trend Micro VPN Proxy One Pro, version 5.8.1012 and below is vulnerable to an arbitrary file overwrite or create attack but is limited to loCVE-2024-364747.8An integer overflow vulnerability exists in the Compound Document Binary File format parser of the GNOME Project G Structured File Library (CVE-2024-364758.8FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. contain an active debug code vulnerability. If a user CVE-2024-364765.5In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Ensure 'ib_sge list' is accessible Move the declaration of CVE-2024-364777.8In the Linux kernel, the following vulnerability has been resolved: tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer bufferCVE-2024-364785.5In the Linux kernel, the following vulnerability has been resolved: null_blk: fix null-ptr-dereference while configuring 'power' and 'submiCVE-2024-364795.5In the Linux kernel, the following vulnerability has been resolved: fpga: bridge: add owner module and take its refcount The current impleCVE-2024-36485.4The ShareThis Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sharethis-inline-button' shoCVE-2024-364809.8Use of hard-coded credentials issue exists in Ricoh Streamline NX PC Client ver.3.7.2 and earlier. If this vulnerability is exploited, an atCVE-2024-364815.5In the Linux kernel, the following vulnerability has been resolved: tracing/probes: fix error check in parse_btf_field() btf_find_struct_mCVE-2024-364826.7Improper input validation in some Intel(R) CIP software before version 2.4.10852 may allow a privileged user to potentially enable escalatio
CVE-2024-36471: High severity, CVSS 7.5 | Vulnix