VYPR
← All advisories
Critical severityNVD Advisory· Published Mar 15, 2024· Updated Feb 13, 2025

Apache CXF SSRF Vulnerability using the Aegis databinding

CVE-2024-28752

Description

A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the default databinding) are not impacted.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.cxf:cxf-rt-databinding-aegisMaven
< 3.5.83.5.8
org.apache.cxf:cxf-rt-databinding-aegisMaven
>= 3.6.0, < 3.6.33.6.3
org.apache.cxf:cxf-rt-databinding-aegisMaven
>= 4.0.0, < 4.0.44.0.4

Affected products

126

Patches

Vulnerability mechanics

References

7

News mentions

0

No linked articles in our index yet.