A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the default databinding) are not impacted.
References
Configurations
No configuration.
History
13 Feb 2025, 18:17
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the default databinding) are not impacted. |
21 Nov 2024, 09:06
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.openwall.com/lists/oss-security/2024/03/14/3 - | |
| References | () https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt - | |
| References | () https://security.netapp.com/advisory/ntap-20240517-0001/ - |
01 Aug 2024, 13:49
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.3 |
10 Jun 2024, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
01 May 2024, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
15 Mar 2024, 11:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-03-15 11:15
Updated : 2025-02-13 18:17
NVD link : CVE-2024-28752
Mitre link : CVE-2024-28752
CVE.ORG link : CVE-2024-28752
JSON object : View
Products Affected
No product.
CWE
CWE-918
Server-Side Request Forgery (SSRF)