CVE-2024-28752 Security Details

CVE ID

CVE-2024-28752

CWE

CWE-918

CVE Description

A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the default databinding) are not impacted.

Published

Mar 18, 2024

CVSS Score & Severity

9.3Critical

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

EPSS Score

46.602%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/apache/cxf/aegis/type/mtom/AttachmentUtil.getAttachment(Ljava/lang/String;Ljava/util/Collection;)Lorg/apache/cxf/message/Attachment;

JVM

Affected Ecosystems

affected

Source

National Vulnerability Database

References

GitHub · Advisory · GHSA-qmgx-j96g-4428THIRD_PARTY