Cyber Resilience

CVE-2024-48360

HighPublic PoC

Published: 31 October 2024

Published
31 October 2024
Modified
01 July 2025
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.9096 99.7th percentile
Risk Priority 70 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-48360 is a high-severity SSRF (CWE-918) vulnerability in Qualitor Qualitor. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

Qualitor v8.24 contains a server-side request forgery vulnerability in the component /request/viewValidacao.php. The flaw is tracked as CVE-2024-48360 and carries a CVSS 3.1 score of 7.5, reflecting network-accessible attack complexity that is low and requires no authentication or user interaction. It is classified under CWE-918.

An unauthenticated remote attacker can supply crafted input to the affected endpoint and cause the application to issue arbitrary requests to internal or external resources. Successful exploitation yields high confidentiality impact by allowing the attacker to read data otherwise inaccessible from outside the network.

Official advisories and patch information are published by the vendor at https://www.qualitor.com.br/official-security-advisory-cve-2024-48360 and https://www.qualitor.com.br/qualitor-8-20, while a technical analysis and proof-of-concept are available at https://github.com/OpenXP-Research/CVE-2024-48360. The associated EPSS score has reached 0.9096.

EU & UK References

Vulnerability details

Qualitor v8.24 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /request/viewValidacao.php.

CWE(s)
CWE-918

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1046 Network Service Discovery Discovery
Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation.
attack.mitre.org →
Why these techniques?

Unauthenticated SSRF in public-facing Qualitor application enables exploitation of public-facing application (T1190) and facilitates internal network service/port enumeration (T1046).

Affected Assets

qualitor
qualitor
8.20, 8.24

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CA-8 Penetration Testing
addresses: CWE-918

Penetration testing attempts server-side requests to internal resources, identifying SSRF weaknesses for remediation.

SC-7 Boundary Protection
addresses: CWE-918

Outbound connections to external resources can be monitored and limited at the boundary, reducing SSRF impact.

SI-10 Information Input Validation
addresses: CWE-918

Validates server-side URLs and resource references to block SSRF attempts.

SI-4 System Monitoring
addresses: CWE-918

Detects server-side request forgery through monitoring of unexpected outbound connections.

References