SSRF Vulnerability in Apache CXF Could Allow Attacker to Perform SSRF Style Attacks
CVE-2024-28752

9.3CRITICAL

Key Information:

Vendor
Apache
Status
Apache Cxf
Vendor
CVE Published:
15 March 2024

Summary

An SSRF vulnerability exists in the Aegis DataBinding of Apache CXF in versions prior to 4.0.4, 3.6.3, and 3.5.8. This flaw enables attackers to exploit web services that accept at least one parameter of any type, potentially leading to unauthorized access or manipulation of internal services. Users employing other data bindings, including the default, are not affected by this issue.

Affected Version(s)

Apache CXF 0 < 4.0.4, 3.6.3, 3.5.8

References

https://cxf.apache.org/security-advisories.data/CVE-2024-...
vendor-advisory
http://www.openwall.com/lists/oss-security/2024/03/14/3
https://security.netapp.com/advisory/ntap-20240517-0001/

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tobias S. Fink
.