CVE-2024-25294

CRITICAL EPSS 57.0%

Published Mar 20, 20242y ago · Modified Jun 17, 20262w ago

9.1 CVSS 3.1

Critical

Published Mar 20, 2024 2y ago

Last Modified Jun 17, 2026 2w ago

Description

An SSRF issue in REBUILD v.3.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via the FileDownloader.java, proxyDownload,URL parameters.

CVSS Details

Base Score

9.1

Exploitability

3.9

Impact

5.2

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability None

Threat Intelligence

EPSS Exploit Probability

57.0% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-918 Server-Side Request Forgery (SSRF) Validation

Affected Products 1

Vendor	Product	Version	Range
getrebuild	rebuild	3.5.0	any

References 3

rebuild.com http://rebuild.com

Not Applicable
deeply-capri-1c8.notion.site https://deeply-capri-1c8.notion.site/REBUILD-V3-5-2023-12-11-SSRF-30324be04e00477eae472bf75f4f5e0d

Broken Link
github.com https://github.com/getrebuild/rebuild/

Product

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.