PT-2024-4249 · Apache · Apache Cxf

Tobias S. Fink · Published 2024-03-14 · Updated 2026-04-07 · CVE-2024-28752

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.0.4 Apache CXF versions prior to 3.6.3 Apache CXF versions prior to 3.5.8

Description A Server-Side Request Forgery (SSRF) vulnerability in Apache CXF's Aegis DataBinding allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings, including the default databinding, are not impacted.

Recommendations For Apache CXF versions prior to 4.0.4, update to version 4.0.4 or later. For Apache CXF versions prior to 3.6.3, update to version 3.6.3 or later. For Apache CXF versions prior to 3.5.8, update to version 3.5.8 or later. As a temporary workaround, consider disabling the Aegis DataBinding until a patch is available.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2024-04736

CVE-2024-28752

GHSA-QMGX-J96G-4428

RHSA-2024:10207

RHSA-2024:10208

RHSA-2024:3559

RHSA-2024:3560

RHSA-2024:3561

RHSA-2024:5479

RHSA-2024:5481

Affected Products

Apache Cxf

References · 24

• https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-28752 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04736 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-28752 · Security Note
• https://osv.dev/vulnerability/GHSA-qmgx-j96g-4428 · Vendor Advisory
• https://github.com/apache/cxf/commit/d0baeb3ee64c6d7c883bd2f5c4cb0de6b0b5f463 · Note
• https://github.com/apache/cxf · Note
• https://openwall.com/lists/oss-security/2024/03/14/3 · Note
• https://twitter.com/pdnuclei_bot/status/2041335189192966601 · Twitter Post
• https://twitter.com/Komodosec/status/1769402584199286958 · Twitter Post
• https://security.netapp.com/advisory/ntap-20240517-0001 · Note
• https://twitter.com/Dinosn/status/1768499408922914836 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1768466390997197174 · Twitter Post
• https://tenable.com/cve/CVE-2024-28752 · Note