What’s Vulnerable › Vulnerabilities

CVE-2024-28752: Apache CXF SSRF Vulnerability using the Aegis databinding

• Severity: critical (CVSS 9.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-03-15 · updated 2026-06-17
• Weakness: CWE-918

Description

A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the default databinding) are not impacted.

Affected products

• Apache Software Foundation Apache CXF: before 3.5.8; from 3.6.0 before 3.6.3; from 4.0.0 before 4.0.4 — fixed in 3.5.8, 3.6.3, 4.0.4
• NetApp OnCommand Workflow Automation: all versions
• NetApp Ontap Tools: 10

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache CXF 3.5.8, 3.6.3, 4.0.4. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2024/03/14/3
• https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt
• https://security.netapp.com/advisory/ntap-20240517-0001/
• http://www.openwall.com/lists/oss-security/2024/03/14/3
• https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt
• https://security.netapp.com/advisory/ntap-20240517-0001/

Get alerted when CVE-2024-28752 or the next vulnerability affects your stack