CVSS 3.1
9.3 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:NCVE-2024-28752
A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the default databinding) are not impacted.
Severity
- EPSS
- 2.9% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
- CWE
- CWE-918
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:cxf
- netapp:oncommand_workflow_automation
- netapp:ontap_tools
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-qmgx-j96g-4428 | Maven | org.apache.cxf:cxf-rt-databinding-aegis | <3.5.8 | 3.5.8 |
| GHSA-qmgx-j96g-4428 | Maven | org.apache.cxf:cxf-rt-databinding-aegis | >=3.6.0 <3.6.3 | 3.6.3 |
| GHSA-qmgx-j96g-4428 | Maven | org.apache.cxf:cxf-rt-databinding-aegis | >=4.0.0 <4.0.4 | 4.0.4 |