CVE-2024-28752
Assigner: apache
Published: 2024-03-15T10:27:30.083Z
State: PUBLISHED
affected: defaultStatus: unaffected
packageName: org.apache.cxf.aegis
product: Apache CXF
vendor: Apache Software Foundation
versions: lessThan: 4.0.4, 3.6.3, 3.5.8
status: affected
version: 0
versionType: semver
credits: type: finder
value: Tobias S. Fink
descriptions: supportingMedia: base64: no
type: text/html
value: A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the default databinding) are not impacted.<br><br>
value: A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the default databinding) are not impacted.


metrics: other: content: text: important
type: Textual description of severity
problemTypes: descriptions: cweId: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
type: CWE
source: discovery: EXTERNAL
title: Apache CXF SSRF Vulnerability using the Aegis databinding
x_generator: engine: Vulnogram 0.1.0-dev