CVE-2024-52602: t2bot matrix-media-repo

csirt@kutim:~/threat-intel/cve/CVE-2024-52602

CVSS 5.3 · Medium EPSS 0,57%

Kerentanan Server-Side Request Forgery (SSRF) pada t2bot matrix-media-repo. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. Matrix Media Repo (MMR) is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. This is fixed in MMR v1.3.8. Users are advised to upgrade. Restricting which hosts MMR is allowed to contact via (local) firewall rules or a transparent proxy and may provide a workaround for users unable to upgrade.

Rincian

Terbit di NVD: 16 Januari 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-918: Server-Side Request Forgery (SSRF)
EPSS (30 hari): 0,57% peluang dieksploitasi; lebih tinggi dari 45,8% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
t2bot	matrix-media-repo	Semua versi sebelum 1.3.8

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/t2bot/matrix-media-repo/security/advisories/GHSA-r6jg-jfv6-2fjv advisory vendor
https://github.com/t2bot/matrix-media-repo/releases/tag/v1.3.8 release notes
https://learn.snyk.io/lesson/ssrf-server-side-request-forgery deskripsi teknis
https://owasp.org/www-community/attacks/Server_Side_Request_Forgery deskripsi teknis
https://www.agwa.name/blog/post/preventing_server_side_request_forgery_in_golang deskripsi teknis

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.