{"id":"CVE-2024-51408","aliases":["BIT-appsmith-2024-51408","EUVD-2024-45343","GHSA-94hw-32gv-86pf"],"status":"published","title":"AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests...","description":"AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests to 169.254.169.254 to retrieve AWS metadata credentials.","severity":{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00483,"percentile":0.41956,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-918"],"published":"2024-11-04T00:00:00Z","modified":"2026-10-28T02:31:02Z","fixes":[{"ecosystem":"Bitnami","package":"appsmith","fixed_in":["1.46.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"appsmith","ranges":[{"type":"SEMVER","events":[{"introduced":"1.8.3"},{"fixed":"1.46.0"}]}]}],"products":[{"vendor":"appsmith","product":"appsmith"}],"references":[{"url":"https://github.com/appsmithorg/appsmith/pull/29286","tags":["Issue Tracking","report","fix"]},{"url":"https://github.com/jahithoque/Vulnerability-Research/tree/main/CVE-2024-51408","tags":["Exploit","evidence","web"]},{"url":"https://github.com/appsmithorg/appsmith/releases/tag/v1.46","tags":["Release Notes","article","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-51408","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-94hw-32gv-86pf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/51xxx/CVE-2024-51408.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-51408","description":"AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests to 169.254.169.254 to retrieve AWS metadata credentials.","status":"published","published":"2024-11-04T00:00:00Z","modified":"2024-11-05T21:26:15.936Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N","level":"high","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:34:01.630882Z"}],"euvd":[{"id":"EUVD-2024-45343","description":"AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests to 169.254.169.254 to retrieve AWS metadata credentials.","status":"published","published":"2024-11-04T00:00:00Z","modified":"2024-11-05T21:26:15Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N","level":"high"}],"updated_at":"2026-11-03T00:05:10.508802Z"}],"ghsa":[{"id":"GHSA-94hw-32gv-86pf","title":"AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests...","description":"AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests to 169.254.169.254 to retrieve AWS metadata credentials.","status":"published","published":"2024-11-04T15:31:58Z","modified":"2024-11-06T00:32:58Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:58:44.780147Z"}],"nvd":[{"id":"CVE-2024-51408","description":"AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests to 169.254.169.254 to retrieve AWS metadata credentials.","status":"published","published":"2024-11-04T14:15:16.603Z","modified":"2026-06-17T08:05:41.007Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:10:35.864552Z"}],"osv":[{"id":"CVE-2024-51408","description":"AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests to 169.254.169.254 to retrieve AWS metadata credentials.","status":"published","published":"2024-11-04T00:00:00Z","modified":"2026-10-28T02:31:02.858656192Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N","level":"high"}],"updated_at":"2026-11-02T15:44:44.032344Z"},{"id":"BIT-appsmith-2024-51408","description":"AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests to 169.254.169.254 to retrieve AWS metadata credentials.","status":"published","published":"2024-11-07T07:07:47.085Z","modified":"2026-09-10T16:01:07.724762891Z","updated_at":"2026-11-02T15:28:28.267217Z"}]}}