GHSA-hf86-8x8v-h7vc
Apache EventMesh Vulnerable to Server-Side Request Forgery in WebhookUtil.java
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.apache.eventmesh:eventmesh-runtime | >= 1.6.0-release, <= 1.11.0-release | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
Server-Side Request Forgery (SSRF) in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources.
Users are recommended to upgrade to version 1.12.0 or use the master branch, which fixes this issue.
References
External links from the advisory. They lead to third-party sites.