CVE-2024-36471: Apache Allura: sensitive information exposure via DNS rebinding
Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL. Project administrators can run these imports, which could cause Allura to read from internal services and expose them.
This issue affects Apache Allura from 1.0.1 through 1.16.0.
Users are recommended to upgrade to version 1.17.0, which fixes the issue. If you are unable to upgrade, set "disableentrypoints.allura.importers = forge-tracker, forge-discussion" in your .ini config file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36471?
CVE-2024-36471 has been classified as a critical vulnerability due to the potential for extensive internal service exposure.
How do I fix CVE-2024-36471?
To fix CVE-2024-36471, upgrade Apache Allura to version 1.16.0 or later.
What impact does CVE-2024-36471 have on systems using Apache Allura?
CVE-2024-36471 allows attackers to exploit DNS rebinding attacks, potentially exposing sensitive internal services.
Who is affected by CVE-2024-36471?
Project administrators using Apache Allura versions from 1.0.1 to 1.16.0 are affected by CVE-2024-36471.
Is there a workaround for CVE-2024-36471 while I prepare to upgrade?
Currently, there are no reliable workarounds for CVE-2024-36471, and immediate upgrade is recommended to mitigate risks.