CVE-2024-41955 json
Mobile Security Framework (MobSF) has an Open Redirect in Login Redirect
published 2y ago modified 4mo ago also EUVD-2024-2299 , GHSA-8m9j-2f32-2vx4 , PYSEC-2026-1669
- cvss
- 5.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 63%
- public exploits
- 0
- none known
Summary
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. An open redirect vulnerability exist in MobSF authentication view. Update to MobSF v4.0.5.
Patch / fix
- pypi mobsf 4.0.5
- opensecurity mobile_security_framework 4.0.5
Is CVE-2024-41955 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2y ago
Exploit prediction
1.00% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-11).
Exploits and checks
- github.com https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-8m9j-2f32-2vx4 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N |
| GitHub | 3.1 | 5.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| OSV | 3.1 | 5.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | mobsf | <4.0.5 |
4.0.5 |
Affected products
- MobSF Mobile-Security-Framework-MobSF
Classification
- Weakness
-
- CWE-601 URL Redirection to Untrusted Site
References
-
github.com
/MobSF/Mobile-Security-Framework-MobSF/commit/fdaad81314f393d324c1ede79627e9d47986c8c8
web, patch
-
github.com
/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-8m9j-2f32-2vx4
web, exploit, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-41955
advisory
-
github.com
/MobSF/Mobile-Security-Framework-MobSF
package
-
pypi.org
/project/mobsf
package
-
github.com
/advisories/GHSA-8m9j-2f32-2vx4
advisory
Sources
- CVE List CVE-2024-41955
- GitHub Advisory GHSA-8m9j-2f32-2vx4
- NVD CVE-2024-41955
- OSV PYSEC-2026-1669
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.