SSRF in Akana API Platform
Priority MEDIUM 46CWE-918Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
A server-side request forgery (SSRF) was discovered in the Akana API Platform in versions prior to and including 2022.1.3. Reported by Jakob Antonsson.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0044 38th percentileScored 2026-11-07
Fix Fixed Akana API Platform (Akana): 2022.1.1 (CVE-2024-2796 Patch), 2022.1.2 (CVE-2024-2796 Patch), 2024.1.0 +1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Perforce | Akana API Platform | 2022.1.1 to before 2022.1.1 (CVE-2024-2796 Patch); 2022.1.2 to before 2022.1.2 (CVE-2024-2796 Patch); 0.0.0 to before 2024.1.0; 0.0.0 to before 2022.1.3.2 | 2022.1.1 (CVE-2024-2796 Patch), 2022.1.2 (CVE-2024-2796 Patch), 2024.1.0, 2022.1.3.2 | Patch available | CNA |
- Akana API Platform VendorPerforce Affected 2022.1.1 to before 2022.1.1 (CVE-2024-2796 Patch); 2022.1.2 to before 2022.1.2 (CVE-2024-2796 Patch); 0.0.0 to before 2024.1.0; 0.0.0 to before 2022.1.3.2 Fixed in 2022.1.1 (CVE-2024-2796 Patch), 2022.1.2 (CVE-2024-2796 Patch), 2024.1.0, 2022.1.3.2 Patch available CNA
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:akana:akana_api_platform:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:akana:akana_api_platform:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
- Fix · CNA Akana API Platform (Akana) Fixed in 2022.1.1 (CVE-2024-2796 Patch), 2022.1.2 (CVE-2024-2796 Patch), 2024.1.0, 2022.1.3.2
Timeline
- 2026-10-02 Threatist record created from CVE-2024-2796
- 2026-10-03 Alias added: GHSA-mr2g-87r5-j9x5
References
More Perforce vulnerabilities
- TI-2026-58853 Unauthenticated Remote Code Execution in Akana API Platform CVSS 4.0CRITICAL 10.0
- TI-2026-71533 Perforce Helix Authentication Service ships a default SCIM token CVSS 4.0CRITICAL 9.3
- TI-2026-05304 Insecure Default Configuration in P4 Server CVSS 4.0HIGH 8.8
- TI-2015-07378 Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to… CVSS 3.1CRITICAL 9.8
- TI-2007-00095 The Perforce client does not restrict the set of files that it overwrites upon receiving… CVSS 2.0HIGH 10.0
- TI-2026-60410 XML External Entity in Akana API Platform CVSS 4.0CRITICAL 9.2
Sources
- CVE-2024-2796 · CVE Program
- CVE-2024-2796 · NVD
- FIRST EPSS
- GHSA-mr2g-87r5-j9x5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences