org.apache.cxf.systests:cxf-systests-databinding (2.7.18), org.apache.cxf.systests:cxf-systests-jaxrs (2.7.18) +9 more potentially affected by CVE-2024-28752 via org.apache.cxf:cxf-rt-databinding-aegis (2.7.18)

org.apache.cxf:cxf-rt-databinding-aegis MAVEN version 2.7.18 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-databinding-aegis and may be impacted: - org.apache.cxf.systests:cxf-systests-databinding 2.7.18 -...

org.apache.cxf.systests:cxf-systests-databinding (>=3.6.0, <=3.6.2), org.apache.cxf.systests:cxf-systests-jaxrs (>=3.6.0, <=3.6.2) +10 more potentially affected by CVE-2024-28752 via org.apache.cxf:cxf-rt-databinding-aegis (>=3.6.0, <=3.6.2)

org.apache.cxf:cxf-rt-databinding-aegis MAVEN version =3.6.0, =3.6.0, =3.6.0, =3.6.0, =3.6.0, =3.6.0, =3.6.0, =3.6.0, =3.6.0, =3.6.0, =3.6.0, =3.6.0, =3.6.0, =3.6.2 Source cves: CVE-2024-28752 Source advisory: GHSA-QMGX-J96G-4428...

io.github.project-openubl:quarkus-xsender-deployment (>=5.0.0.cr1, <=5.1.1), io.quarkiverse.cxf:quarkus-cxf-deployment (>=2.0.0, <=3.8.0) +32 more potentially affected by CVE-2024-28752 via org.apache.cxf:cxf-rt-databinding-aegis (>=4.0.0, <=4.0.3)

org.apache.cxf:cxf-rt-databinding-aegis MAVEN version =4.0.0, =5.0.0.cr1, =2.0.0, =2.7.0.cr1, =2.0.0, =2.2.0, =2.2.1, =2.0.0, =2.0.0, =2.0.0, =3.0.0-m2, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.3 and more Source cves: CVE-2024-28752 Source advisory: GH...

org.apache.cxf:cxf-anttasks (2.1.3), org.apache.cxf:cxf-eclipse-plugin (2.1.3) +5 more potentially affected by CVE-2024-28752 via org.apache.cxf:cxf-rt-databinding-aegis (2.1.3)

org.apache.cxf:cxf-rt-databinding-aegis MAVEN version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-databinding-aegis and may be impacted: - org.apache.cxf:cxf-anttasks 2.1.3 - org.apache.cxf:cxf-eclipse-plugin 2.1.3 -...

org.apache.cxf:apache-cxf (2.0.10), org.apache.cxf:cxf-distribution-manifest (2.0.10) +1 more potentially affected by CVE-2024-28752 via org.apache.cxf:cxf-rt-databinding-aegis (2.0.10)

org.apache.cxf:cxf-rt-databinding-aegis MAVEN version 2.0.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-databinding-aegis and may be impacted: - org.apache.cxf:apache-cxf 2.0.10 - org.apache.cxf:cxf-distribution-manifest 2.0....

org.apache.cxf.systests:cxf-systests-databinding (2.6.7), org.apache.cxf.systests:cxf-systests-jaxrs (2.6.7) +9 more potentially affected by CVE-2024-28752 via org.apache.cxf:cxf-rt-databinding-aegis (2.6.7)

org.apache.cxf:cxf-rt-databinding-aegis MAVEN version 2.6.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-databinding-aegis and may be impacted: - org.apache.cxf.systests:cxf-systests-databinding 2.6.7 -...

org.apache.cxf.systests:cxf-systests-databinding (2.5.4), org.apache.cxf.systests:cxf-systests-jaxrs (2.5.4) +12 more potentially affected by CVE-2024-28752 via org.apache.cxf:cxf-rt-databinding-aegis (2.5.4)

org.apache.cxf:cxf-rt-databinding-aegis MAVEN version 2.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-databinding-aegis and may be impacted: - org.apache.cxf.systests:cxf-systests-databinding 2.5.4 -...

org.apache.cxf.systests:cxf-systests-databinding (2.3.2), org.apache.cxf.systests:cxf-systests-jaxrs (2.3.2) +13 more potentially affected by CVE-2024-28752 via org.apache.cxf:cxf-rt-databinding-aegis (2.3.2)

org.apache.cxf:cxf-rt-databinding-aegis MAVEN version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-databinding-aegis and may be impacted: - org.apache.cxf.systests:cxf-systests-databinding 2.3.2 -...

org.apache.cxf.systests:cxf-systests-databinding (2.5.8), org.apache.cxf.systests:cxf-systests-jaxrs (2.5.8) +9 more potentially affected by CVE-2024-28752 via org.apache.cxf:cxf-rt-databinding-aegis (2.5.8)

org.apache.cxf:cxf-rt-databinding-aegis MAVEN version 2.5.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-databinding-aegis and may be impacted: - org.apache.cxf.systests:cxf-systests-databinding 2.5.8 -...

SSRF vulnerability using the Aegis DataBinding in Apache CXF

A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings including the default databinding are not impacted...

org.apache.cxf.systests:cxf-systests-databinding (2.4.2), org.apache.cxf.systests:cxf-systests-jaxrs (2.4.2) +11 more potentially affected by CVE-2024-28752 via org.apache.cxf:cxf-rt-databinding-aegis (2.4.2)

org.apache.cxf:cxf-rt-databinding-aegis MAVEN version 2.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-databinding-aegis and may be impacted: - org.apache.cxf.systests:cxf-systests-databinding 2.4.2 -...

org.apache.cxf.systests:cxf-systests-databinding (2.2.7), org.apache.cxf.systests:cxf-systests-jaxrs (2.2.7) +8 more potentially affected by CVE-2024-28752 via org.apache.cxf:cxf-rt-databinding-aegis (2.2.7)

org.apache.cxf:cxf-rt-databinding-aegis MAVEN version 2.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-databinding-aegis and may be impacted: - org.apache.cxf.systests:cxf-systests-databinding 2.2.7 -...

org.apache.cxf.systests:cxf-systests-databinding (2.6.8), org.apache.cxf.systests:cxf-systests-jaxrs (2.6.8) +11 more potentially affected by CVE-2024-28752 via org.apache.cxf:cxf-rt-databinding-aegis (2.6.8)

org.apache.cxf:cxf-rt-databinding-aegis MAVEN version 2.6.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-databinding-aegis and may be impacted: - org.apache.cxf.systests:cxf-systests-databinding 2.6.8 -...

CVE-2024-28752

A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings including the default databinding are not impacted...

CVE-2024-28752 Apache CXF SSRF Vulnerability using the Aegis databinding

A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings including the default databinding are not impacted...

be.selckin.util:cxf-php-soap-codegen (0.1), com.custardsource.parfait:parfait-cxf (>=0.2.0, <=0.3.10) +144 more potentially affected by CVE-2024-28752 via org.apache.cxf:cxf-rt-databinding-aegis (>=2.0.6, <=3.5.7)

org.apache.cxf:cxf-rt-databinding-aegis MAVEN version =2.0.6, =0.2.0, =2.2.1, =1.0.3, =1.0.3, =1.0.3, =0.9-milestone1, =0.1-milestone, =0.1-milestone, =0.9-milestone1, =0.1-milestone, =0.1-milestone, =0.9-milestone1, =0.9-milestone3, =0.9-milestone6.6 and more Source cves: CVE-2024-28752 Source...

io.github.project-openubl:quarkus-xsender-deployment (>=5.0.0.cr1, <=5.1.1), io.quarkiverse.cxf:quarkus-cxf-deployment (>=2.0.0, <=3.8.0) +32 more potentially affected by CVE-2024-28752 via org.apache.cxf:cxf-rt-databinding-aegis (>=4.0.0, <=4.0.3)

org.apache.cxf:cxf-rt-databinding-aegis MAVEN version =4.0.0, =5.0.0.cr1, =2.0.0, =2.7.0.cr1, =2.0.0, =2.2.0, =2.2.1, =2.0.0, =2.0.0, =2.0.0, =3.0.0-m2, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.3 and more Source cves: CVE-2024-28752 Source advisory: ME...

org.apache.cxf.systests:cxf-systests-databinding (>=3.6.0, <=3.6.2), org.apache.cxf.systests:cxf-systests-jaxrs (>=3.6.0, <=3.6.2) +10 more potentially affected by CVE-2024-28752 via org.apache.cxf:cxf-rt-databinding-aegis (>=3.6.0, <=3.6.2)

org.apache.cxf:cxf-rt-databinding-aegis MAVEN version =3.6.0, =3.6.0, =3.6.0, =3.6.0, =3.6.0, =3.6.0, =3.6.0, =3.6.0, =3.6.0, =3.6.0, =3.6.0, =3.6.0, =3.6.0, =3.6.2 Source cves: CVE-2024-28752 Source advisory: MEND:CVE-2024-28752...

CVE-2024-28752 Apache CXF SSRF Vulnerability using the Aegis databinding

A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings including the default databinding are not impacted...

CVE-2024-28752

A Server-Side Request Forgery (SSRF) vulnerability exists in Apache CXF before versions 4.0.4 , 3.6.3 , and 3.5.8 when utilizing the Aegis DataBinding . The root cause lies in the XOP Include mechanism within multipart SOAP requests, which allows an attacker to abuse the href attribute to read lo...