CVE-2024-52579

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Misskey is an open source, federated social media platform. Some APIs using `HttpRequestService` do not properly check the target host. This vulnerability allows an attacker to send POST or GET requests to the internal server, which may result in a SSRF attack.It allows an attacker to send POST or GET requests (with some controllable URL parameters) to private IPs, enabling further attacks on internal servers. This issue has been addressed in version 2024.11.0-alpha.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-20 CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Dec 18, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-52584.3An authorization vulnerability exists within GitLab from versions 16.10 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1 where a CVE-2024-525817.5Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.13.0, the multipart form parser shipped with lites CVE-2024-525824.7Cachi2 is a command-line interface tool that pre-fetches a project's dependencies to aid in making the project's build process network-isola CVE-2024-525838.2The WesHacks GitHub repository provides the official Hackathon competition website source code for the Muweilah Wesgreen Hackathon. The page CVE-2024-525845.4Autolab is a course management service that enables auto-graded programming assignments. There is a vulnerability in version 3.0.1 where CAs CVE-2024-525855.4Autolab is a course management service that enables auto-graded programming assignments. There is an HTML injection vulnerability in version CVE-2024-525867.8eLabFTW is an open source electronic lab notebook for research labs. A vulnerability has been found starting in version 4.6.0 and prior to v CVE-2024-525878.8StepSecurity's Harden-Runner provides network egress filtering and runtime security for GitHub-hosted and self-hosted runners. Versions of s CVE-2024-525887.5Strapi is an open-source content management system. Prior to version 4.25.2, inputting a local domain into the Webhooks URL field leads to t CVE-2024-525892.7Discourse is an open source platform for community discussion. Moderators can see the Screened emails list in the admin dashboard, and throu CVE-2024-52595.4The MultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution plugin for WordPress is vulnerable to Stored Cross-Site Scriptin CVE-2024-525906.5Misskey is an open source, federated social media platform. In affected versions missing validation in `ApRequestService.signedGet` allows a