CVE-2024-29190 in Mobile Security Framework (MobSF) allows for potential Server-Side Request Forgery (SSRF) attacks. This vulnerability exists because MobSF versions 3.9.5 Beta and earlier lack input validation when extracting hostnames from android:host attributes. An attacker can exploit this to force the server to connect to internal services, potentially exposing sensitive data and internal infrastructure.

With a SOCRadar Vulnerability Risk Score (SVRS) of 30, this vulnerability is currently considered low severity, suggesting a lower immediate risk compared to vulnerabilities with higher SVRS scores. However, the presence of CWE-918 highlights the inherent danger of SSRF vulnerabilities. Although the CVSS score is 7.5 indicating high severity, the low SVRS might reflect limited real-world exploitation or available exploits. A hotfix is available in commit 5a8eeee73c5f504a6c3abdf2a139a13804efdb77. Organizations using MobSF should apply the patch to mitigate potential risks.