CVE-2024-31215 json
Mobile Security Framework (MobSF) vulnerable to Server-Side Request Forgery (SSRF) in firebase database check
published 2024-04-04 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-1325 , GHSA-wpff-wm84-x5cx , PYSEC-2026-1676
- cvss
- 6.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 43%
- public exploits
- 0
- none known
Summary
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. A SSRF vulnerability in firebase database check logic. The attacker can cause the server to make a connection to internal-only services within the organization’s infrastructure. When a malicious app is uploaded to Static analyzer, it is possible to make internal requests. This vulnerability has been patched in version 3.9.8.
Patch / fix
- pypi mobsf 3.9.8
- opensecurity mobile_security_framework 3.9.8
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.51% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L |
| GitHub | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L |
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
| OSV | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | mobsf | <3.9.8 |
3.9.8 |
Affected products
- MobSF Mobile-Security-Framework-MobSF
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/MobSF/Mobile-Security-Framework-MobSF/pull/2373
web, issue-tracking, patch
-
github.com
/MobSF/Mobile-Security-Framework-MobSF/commit/43bb71d115d78c03faa82d75445dd908e9b32716
web, patch
-
github.com
/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-wpff-wm84-x5cx
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-31215
advisory
-
github.com
/MobSF/Mobile-Security-Framework-MobSF
package
-
pypi.org
/project/mobsf
package
-
github.com
/advisories/GHSA-wpff-wm84-x5cx
advisory
Sources
- CVE List CVE-2024-31215
- GitHub Advisory GHSA-wpff-wm84-x5cx
- NVD CVE-2024-31215
- OSV PYSEC-2026-1676
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.