Paper/Archive/CVE-2024-55089

CVE-2024-55089

Rhymix Rhymix — Rhymix before 2.1.24 is vulnerable to Server-Side Request Forgery (SSRF) in the background import data function because XML documents may…

EPSS 0.2%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (ADP)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 12.0.120 × 202.4 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Rhymix before 2.1.24 is vulnerable to Server-Side Request Forgery (SSRF) in the background import data function because XML documents may contain external entities.

Affected

ProductAffectedFixed inSource

Rhymix< 2.1.242.1.24CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

mitre (CNA)4.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

reftasteful-stamp-da4.notion.site/CVE-2024-55089-15b1e0f227cb8064a563c697709b7530?pvs=73 refgithub.com/rhymix/rhymix/commit/464985b1ef382cc8cf852e9b028a960aa58b40c3 refrhymix.org/news/1909005