CVE-2024-23838

TrueLayer.NET is the .Net client for TrueLayer. The vulnerability could potentially allow a malicious actor to gain control over the destination URL of the HttpClient used in the API classes. For applications using the SDK, requests to unexpected resources on local networks or to the internet could be made which could lead to information disclosure. The issue can be mitigated by having strict egress rules limiting the destinations to which requests can be made, and applying strict validation to any user input passed to the `truelayer-dotnet` library. Versions of TrueLayer.Client `v1.6.0` and later are not affected.

• CWE-918

• https://github.com/TrueLayer/truelayer-dotnet/commit/75e436ed5360faa73d6e7ce3a9903a3c49505e3ePatch
• https://github.com/TrueLayer/truelayer-dotnet/security/advisories/GHSA-67m4-qxp3-j6hhVendor Advisory
• https://github.com/TrueLayer/truelayer-dotnet/commit/75e436ed5360faa73d6e7ce3a9903a3c49505e3ePatch
• https://github.com/TrueLayer/truelayer-dotnet/security/advisories/GHSA-67m4-qxp3-j6hhVendor Advisory

Published

Jan 30, 2024

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-23832Mastodon is a free, open-source social network server based …9.8
• CVE-2024-23833OpenRefine is a free, open source power tool for working wit…7.5
• CVE-2024-23834Discourse is an open-source discussion platform. Improperly …6.1
• CVE-2024-23835Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2024-23836Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2024-23837LibHTP is a security-aware parser for the HTTP protocol. Cra…7.5
• CVE-2024-23839Suricata is a network Intrusion Detection System, Intrusion …8.1
• CVE-2024-2384The WooCommerce POS plugin for WordPress is vulnerable to in…4.3
• CVE-2024-23840GoReleaser builds Go binaries for several platforms, creates…5.5
• CVE-2024-23841apollo-client-nextjs is the Apollo Client support for the Ne…6.1
• CVE-2024-23842Improper Input Validation in Hitron Systems DVR LGUVR-16H 1.…7.5
• CVE-2024-23843Improper Neutralization of Special Elements used in an SQL C…2.2