Description
A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the default databinding) are not impacted.
Metrics
CVSS 3.1 9.3/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache CXF | < 4.0.4, 3.6.3, 3.5.8 |
| netapp | oncommand_workflow_automation | 0 |
| apache | cxf | < 4.0.4; < 3.6.3; < 3.5.8 |
References
- http://www.openwall.com/lists/oss-security/2024/03/14/3Mailing List
- https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txtVendor Advisory
- https://security.netapp.com/advisory/ntap-20240517-0001/Third Party Advisory
- http://www.openwall.com/lists/oss-security/2024/03/14/3Mailing List
- https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txtVendor Advisory
- https://security.netapp.com/advisory/ntap-20240517-0001/Third Party Advisory
Timeline
- Published
- Mar 15, 2024
- Last modified
- Jun 17, 2026
- NVD status
- Analyzed