CVE-2024-54000

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In versions prior to 3.9.7, the requests.get() request in the _check_url method is specified as allow_redirects=True, which allows a server-side request forgery when a request to .well-known/assetlinks.json" returns a 302 redirect. This is a bypass of the fix for CVE-2024-29190 and is fixed in 3.9.7.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
MobSF	Mobile-Security-Framework-MobSF	< 3.9.7
mobsf	mobile_security_framework	< 3.9.7

References

Timeline

Published: Dec 3, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-540015.5Kanboard is project management software that focuses on the Kanban methodology. HTML can be injected and stored into the application setting CVE-2024-540025.3Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Perfor CVE-2024-540038.0Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site scripting (XSS) vulnerability CVE-2024-540044.3Jenkins Filesystem List Parameter Plugin 0.0.14 and earlier does not restrict the path used for the File system objects list Parameter, allo CVE-2024-540055.1A vulnerability has been identified in COMOS V10.3 (All versions < V10.3.3.5.8), COMOS V10.4.0 (All versions), COMOS V10.4.1 (All versions),CVE-2024-540067.2Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated re CVE-2024-540077.2Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated re CVE-2024-540087.2An authenticated Remote Code Execution (RCE) vulnerability exists in the AirWave CLI. Successful exploitation of this vulnerability could al CVE-2024-540094.0Remote authentication bypass vulnerability in HPE Alletra Storage MP B10000 in versions prior to version 10.4.5 could be remotely exploited CVE-2024-54018.8Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-CVE-2024-540103.4A vulnerability in the firewall component of HPE Aruba Networking CX 10000 Series Switches exists. It could allow an unauthenticated adjace CVE-2024-540116.5Penetration Testing engineers at Amazon have discovered a flaw where the camera system fails to properly handle data supplied in certain req