CVE-2024-52602

Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. Matrix Media Repo (MMR) is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. This is fixed in MMR v1.3.8. Users are advised to upgrade. Restricting which hosts MMR is allowed to contact via (local) firewall rules or a transparent proxy and may provide a workaround for users unable to upgrade.

• CWE-918

• https://github.com/t2bot/matrix-media-repo/releases/tag/v1.3.8Release Notes
• https://github.com/t2bot/matrix-media-repo/security/advisories/GHSA-r6jg-jfv6-2fjvVendor Advisory
• https://learn.snyk.io/lesson/ssrf-server-side-request-forgeryTechnical Description
• https://owasp.org/www-community/attacks/Server_Side_Request_ForgeryTechnical Description
• https://www.agwa.name/blog/post/preventing_server_side_request_forgery_in_golangTechnical Description

Published

Jan 16, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-525972FAuth is a web app to manage Two-Factor Authentication (2FA…6.1
• CVE-2024-525982FAuth is a web app to manage Two-Factor Authentication (2FA…7.5
• CVE-2024-52599Tuleap is an open source suite to improve management of soft…5.4
• CVE-2024-5260The Sina Extension for Elementor (Slider, Gallery, Form, Mod…5.4
• CVE-2024-52600Statmatic is a Laravel and Git powered content management sy…5.3
• CVE-2024-52601iTop is an web based IT Service Management tool. Prior to ve…6.5
• CVE-2024-52606SolarWinds Platform is affected by server-side request forge…9.8
• CVE-2024-5261Improper Certificate Validation vulnerability in LibreOffice…9.8
• CVE-2024-52611The SolarWinds Platform is vulnerable to an information disc…3.5
• CVE-2024-52612SolarWinds Platform is vulnerable to a reflected cross-site …4.8
• CVE-2024-52613A heap-based buffer under-read in tsMuxer version nightly-20…5.5
• CVE-2024-52614Use of hard-coded cryptographic key issue exists in "Kura Su…4