Lucene search

K
cveApacheCVE-2024-28752
HistoryMar 15, 2024 - 11:15 a.m.

CVE-2024-28752

2024-03-1511:15:09
CWE-918
apache
web.nvd.nist.gov
61
cve-2024-28752
ssrf
aegis databinding
apache cxf
security vulnerability

CVSS3

9.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

AI Score

6.2

Confidence

Low

EPSS

0.001

Percentile

26.4%

A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the default databinding) are not impacted.

Affected configurations

Vulners
Vulnrichment
Node
apachecxfRange4.0.4
OR
apachecxfRange3.6.3
OR
apachecxfRange3.5.8
VendorProductVersionCPE
apachecxf*cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "packageName": "org.apache.cxf.aegis",
    "product": "Apache CXF",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "4.0.4, 3.6.3, 3.5.8",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

CVSS3

9.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

AI Score

6.2

Confidence

Low

EPSS

0.001

Percentile

26.4%