{"metadata": {"vulnerability": "CVE-2024-55875", "count": 26, "kinds": {"milestone": 4, "sighting": 14, "kev": 0, "other": 8}}, "data": [{"timestamp": "2024-12-11T15:46:36.420Z", "date_only": false, "value": "2024-12-11T15:46:36.420Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2024-55875", "field": "cveMetadata.dateReserved"}, {"timestamp": "2024-12-12T16:12:49Z", "date_only": false, "value": "2024-12-12T16:12:49.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/http4k/http4k/security/advisories/GHSA-7mj5-hjjj-8rgw", "record": "CVE-2024-55875", "field": "creation_timestamp", "uuid": "79d64f1c-01b9-4b12-8fab-7d1965740308", "url": "https://github.com/http4k/http4k/security/advisories/GHSA-7mj5-hjjj-8rgw", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-12-12T18:56:59.499Z", "date_only": false, "value": "2024-12-12T18:56:59.499Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2024-55875", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2024-12-12T19:03:46.488Z", "date_only": false, "value": "2024-12-12T19:03:46.488997Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/113641404885985284", "record": "CVE-2024-55875", "field": "creation_timestamp", "uuid": "843bd1f4-02f0-49e0-b5c0-35a0df4f0f1a", "url": "https://infosec.exchange/users/cve/statuses/113641404885985284"}, {"timestamp": "2024-12-12T19:15:13Z", "date_only": false, "value": "2024-12-12T19:15:13Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-7MJ5-HJJJ-8RGW", "record": "GHSA-7MJ5-HJJJ-8RGW", "field": "database_specific.nvd_published_at"}, {"timestamp": "2024-12-12T19:15:13.983Z", "date_only": false, "value": "2024-12-12T19:15:13.983", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-55875", "record": "FKIE_CVE-2024-55875", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2024-12-12T19:22:01Z", "date_only": false, "value": "2024-12-12T19:22:01Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-7MJ5-HJJJ-8RGW", "record": "GHSA-7MJ5-HJJJ-8RGW", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2024-12-12T21:21:56Z", "date_only": false, "value": "2024-12-12T21:21:56.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cvedetector/12804", "record": "CVE-2024-55875", "field": "creation_timestamp", "uuid": "8a9b2781-9a58-46ad-8320-98f9853ecd2c", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-55875 - \"HTTP4K XML External Entity Injection (XXE) Vulnerability\"\", \n  \"Content\": \"CVE ID : CVE-2024-55875 \nPublished : Dec. 12, 2024, 7:15 p.m. | 45\u00a0minutes ago \nDescription : http4k is a functional toolkit for Kotlin HTTP applications. Prior to version 5.41.0.0, there is a potential XXE (XML External Entity Injection) vulnerability when http4k handling malicious XML contents within requests, which might allow attackers to read local sensitive information on server, trigger Server-side Request Forgery and even execute code under some circumstances. Version 5.41.0.0 contains a patch for the issue. \nSeverity: 9.8 | CRITICAL \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"12 Dec 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "url": "https://t.me/cvedetector/12804"}, {"timestamp": "2024-12-13T06:30:07Z", "date_only": false, "value": "2024-12-13T06:30:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/9404", "record": "CVE-2024-55875", "field": "creation_timestamp", "uuid": "7ac653fe-3c93-415b-9fef-fb91229d66ab", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1aCVE-2024-55875 | GHSA-7mj5-hjjj-8rgw | http4k first CVE\nURL\uff1ahttps://github.com/JAckLosingHeart/CVE-2024-55875\n\n\u6807\u7b7e\uff1a#CVE-2024", "url": "https://t.me/GithubRedTeam/9404", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-12-13T14:52:57.520Z", "date_only": false, "value": "2024-12-13T14:52:57.520637Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2024-55875", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2024-12-13T14:52:57.520Z", "date_only": false, "value": "2024-12-13T14:52:57.520637Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-55875", "record": "FKIE_CVE-2024-55875", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2024-12-13T14:55:49.763Z", "date_only": false, "value": "2024-12-13T14:55:49.763Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2024-55875", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-12-16T15:16:20Z", "date_only": false, "value": "2024-12-16T15:16:20.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/haj3imad/112", "record": "CVE-2024-55875", "field": "creation_timestamp", "uuid": "c901539d-3491-4693-ae0c-c58ecd3adb7a", "content": "https://github.com/JAckLosingHeart/CVE-2024-55875\n\nCVE-2024-55875 | GHSA-7mj5-hjjj-8rgw | http4k first CVE\n#github #exploit", "url": "https://t.me/haj3imad/112", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-12-16T17:31:59Z", "date_only": false, "value": "2024-12-16T17:31:59.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/HackerArsenal/747", "record": "CVE-2024-55875", "field": "creation_timestamp", "uuid": "0a6e72d6-e3df-431a-aee5-2a7f7baca3a2", "content": "#exploit\n1. CVE-2024-53677:\nCritical Apache Struts RCE\nhttps://github.com/TAM-K592/CVE-2024-53677-S2-067\n\n2. CVE-2024-10793:\nWP Activity Log plugin XSS\nhttps://github.com/windz3r0day/CVE-2024-10793\n\n3. CVE-2024-55875:\nKotlin HTTP XXE/SSRF\nhttps://github.com/JAckLosingHeart/CVE-2024-55875", "url": "https://t.me/HackerArsenal/747", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-12-17T04:11:25Z", "date_only": false, "value": "2024-12-17T04:11:25.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/11564", "record": "CVE-2024-55875", "field": "creation_timestamp", "uuid": "6d74aed7-e7e0-451d-9a6a-42a64fc9ac8f", "content": "#exploit\n1. CVE-2024-53677:\nCritical Apache Struts RCE\nhttps://github.com/TAM-K592/CVE-2024-53677-S2-067\n\n2. CVE-2024-10793:\nWP Activity Log plugin XSS\nhttps://github.com/windz3r0day/CVE-2024-10793\n\n3. CVE-2024-55875:\nKotlin HTTP XXE/SSRF\nhttps://github.com/JAckLosingHeart/CVE-2024-55875", "url": "https://t.me/CyberSecurityTechnologies/11564", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-12-17T12:41:04Z", "date_only": false, "value": "2024-12-17T12:41:04.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberBulletin/1771", "record": "CVE-2024-55875", "field": "creation_timestamp", "uuid": "0d2929a8-55ac-42bd-b274-952e5b6195e1", "content": "\u26a1\ufe0fCVE-2024-55875 (CVSS 9.8): Critical XXE Vulnerability Found in http4k Toolkit.\n\n#CyberBulletin", "url": "https://t.me/CyberBulletin/1771"}, {"timestamp": "2024-12-17T12:41:04Z", "date_only": false, "value": "2024-12-17T12:41:04.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberBulletin/26840", "record": "CVE-2024-55875", "field": "creation_timestamp", "uuid": "45df7c85-dbc8-4f0c-a927-8fbb279fea9d", "content": "\u26a1\ufe0fCVE-2024-55875 (CVSS 9.8): Critical XXE Vulnerability Found in http4k Toolkit.\n\n#CyberBulletin", "url": "https://t.me/CyberBulletin/26840"}, {"timestamp": "2024-12-18T10:36:45Z", "date_only": false, "value": "2024-12-18T10:36:45.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/HackerArsenal/750", "record": "CVE-2024-55875", "field": "creation_timestamp", "uuid": "7c4b5dbf-dd3b-486a-b83c-932c0ae33137", "content": "https://github.com/JAckLosingHeart/CVE-2024-55875\n\nCVE-2024-55875 | GHSA-7mj5-hjjj-8rgw | http4k first CVE\n#github #exploit", "url": "https://t.me/HackerArsenal/750", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-01-27T07:06:33Z", "date_only": false, "value": "2025-01-27T07:06:33.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/suboxone_chatroom/1542", "record": "CVE-2024-55875", "field": "creation_timestamp", "uuid": "e77de99d-7001-434c-a87d-d00ee6659da7", "content": "#exploit\n1. CVE-2024-53677:\nCritical Apache Struts RCE\nhttps://github.com/TAM-K592/CVE-2024-53677-S2-067\n\n2. CVE-2024-10793:\nWP Activity Log plugin XSS\nhttps://github.com/windz3r0day/CVE-2024-10793\n\n3. CVE-2024-55875:\nKotlin HTTP XXE/SSRF\nhttps://github.com/JAckLosingHeart/CVE-2024-55875", "url": "https://t.me/suboxone_chatroom/1542", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-09-15T13:28:32Z", "date_only": false, "value": "2025-09-15T13:28:32.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/acd0294c-4561-4286-a04e-5c02a1c67b1f", "record": "CVE-2024-55875", "field": "creation_timestamp", "uuid": "965c3e44-412c-47a0-852c-e1a966aa200d"}, {"timestamp": "2025-09-16T03:45:03Z", "date_only": false, "value": "2025-09-16T03:45:03.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/acd0294c-4561-4286-a04e-5c02a1c67b1f", "record": "CVE-2024-55875", "field": "creation_timestamp", "uuid": "267625dd-b88c-483d-b3a8-2171daf62136"}, {"timestamp": "2026-06-09T10:42:10.658Z", "date_only": false, "value": "2026-06-09T10:42:10.658Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2024-55875", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-06-09T10:42:10.658Z", "date_only": false, "value": "2026-06-09T10:42:10.658Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2024-55875", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-09T10:42:52Z", "date_only": false, "value": "2026-06-09T10:42:52Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-7MJ5-HJJJ-8RGW", "record": "GHSA-7MJ5-HJJJ-8RGW", "field": "modified"}, {"timestamp": "2026-06-17T08:11:23.553Z", "date_only": false, "value": "2026-06-17T08:11:23.553", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-55875", "record": "FKIE_CVE-2024-55875", "field": "lastModified"}, {"timestamp": "2026-07-20T22:00:04.879Z", "date_only": false, "value": "2026-07-20T22:00:04.879387Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/pphm_HackerNews/106", "record": "CVE-2024-55875", "field": "creation_timestamp", "uuid": "e1b74d6d-6c0d-45fa-9815-dc7ea0a0c661", "content": "CVE-2024-55875 Kotlin Programming Language\n\nhttp4k, a functional toolkit for Kotlin HTTP applications, is vulnerable to potential XML External Entity Injection (XXE) and Server-Side Request Forgery (SSRF) exploitation techniques in versions prior to 5.41.0.0. When handling malicious XML within incoming requests, http4k could enable threat actors to read locally stored sensitive information on the server and, in certain scenarios, execute remote code.", "url": "https://t.me/pphm_HackerNews/106"}], "metrics": {"as_of": "2026-10-28T20:53:54.198Z", "anchors": {"origin": {"timestamp": "2024-12-12T18:56:59.499Z", "date_only": false, "value": "2024-12-12T18:56:59.499Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2024-55875", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2024-12-12T18:56:59.499Z", "date_only": false, "value": "2024-12-12T18:56:59.499Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2024-55875", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2024-12-12T16:12:49Z", "date_only": false, "value": "2024-12-12T16:12:49.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/http4k/http4k/security/advisories/GHSA-7mj5-hjjj-8rgw", "record": "CVE-2024-55875", "field": "creation_timestamp", "uuid": "79d64f1c-01b9-4b12-8fab-7d1965740308", "url": "https://github.com/http4k/http4k/security/advisories/GHSA-7mj5-hjjj-8rgw", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": -9850.499, "hours": -2.736249722222222, "days": -0.1140104050925926, "min_seconds": -9850.499, "max_seconds": -9850.499, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": true, "start": {"timestamp": "2024-12-12T18:56:59.499Z", "date_only": false, "value": "2024-12-12T18:56:59.499Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2024-55875", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2024-12-12T16:12:49Z", "date_only": false, "value": "2024-12-12T16:12:49.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/http4k/http4k/security/advisories/GHSA-7mj5-hjjj-8rgw", "record": "CVE-2024-55875", "field": "creation_timestamp", "uuid": "79d64f1c-01b9-4b12-8fab-7d1965740308", "url": "https://github.com/http4k/http4k/security/advisories/GHSA-7mj5-hjjj-8rgw", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 59191014.699969, "hours": 16441.948527769167, "days": 685.0811886570486, "min_seconds": 59191014.699969, "max_seconds": 59191014.699969, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2024-12-12T18:56:59.499Z", "date_only": false, "value": "2024-12-12T18:56:59.499Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2024-55875", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-28T20:53:54.198Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 59200865.198969, "hours": 16444.684777491388, "days": 685.1951990621412, "min_seconds": 59200865.198969, "max_seconds": 59200865.198969, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2024-12-12T16:12:49Z", "date_only": false, "value": "2024-12-12T16:12:49.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/http4k/http4k/security/advisories/GHSA-7mj5-hjjj-8rgw", "record": "CVE-2024-55875", "field": "creation_timestamp", "uuid": "79d64f1c-01b9-4b12-8fab-7d1965740308", "url": "https://github.com/http4k/http4k/security/advisories/GHSA-7mj5-hjjj-8rgw", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-10-28T20:53:54.198Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}