GHSL-2023-226: GHSL-2023-225, GHSL-2023-226, GHSL-2023-227, and GHSL-2023-228: Server-Side Request Forgery (SSRF) and Denial of Service (DoS) in Mealie - CVE-2024-31991, CVE-2024-31992, CVE-2024-31993, CVE-2024-31994
Published Apr 12, 2024
·Updated
Mealie v1.0.0-RC1.1 is vulnerable to multiple SSRF and DoS vulnerabilities. These vulnerabilities can be leveraged to identify, map, and retrieve the contents of webservers on Mealie’s local network as well as being the victim of, or launching point for, a denial of service attack against a target of the attacker’s choice.
Affected Software
1 affected component
Mealie Mealie=1.0.0-RC1.1
Event History
Apr 12, 2024
Advisory Published
via GitHub Security Lab·12:00 AM
Data Sourced
via GitHub Security Lab·12:00 AM
DescriptionAffected Software
Frequently Asked Questions
1
What could an attacker reach through a vulnerable deployment?
The vulnerabilities can be used to identify, map, and retrieve content from webservers on the Mealie instance's local network. They can also enable denial-of-service activity against a target selected by the attacker.
2
Can the affected server be used to attack systems other than Mealie itself?
Yes. The vulnerable Mealie instance can act as a launching point for a denial-of-service attack against a target of the attacker's choice.