GitHub Advisoryadvisory · Maven

GHSA-hf86-8x8v-h7vc Apache EventMesh Vulnerable to Server-Side Request Forgery in WebhookUtil.java

MEDIUM Published 2025-08-20 Modified 2025-08-20 Official page ↗
Aliases
CVE-2024-39954
Ecosystem
Maven
Packages
org.apache.eventmesh:eventmesh-runtime
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Weaknesses
CWE-918
Reviewed
2025-08-20

Affected packages

• Maven org.apache.eventmesh:eventmesh-runtime: >= 1.6.0-release, <= 1.11.0-release (no fix yet)

Description

Server-Side Request Forgery (SSRF) in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources. Users are recommended to upgrade to version 1.12.0 or use the master branch, which fixes this issue.

Related

Alias · CVE (1)

  • CVE-2024-39954 CWE-918 Server-Side Request Forgery (SSRF) in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References