ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2024-28752

—
CVSS 3.1
9.3 critical
EPSS
2%p84
Published
()
Modified
Description

A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the default databinding) are not impacted.

Vendors
apachenetapp
Products
cxf, oncommand workflow automation, ontap tools
Weakness
CWE-918
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
NVD CVE.org GitHub PoCs EPSS (2.5%)

In the news

No ingested article mentions this CVE yet.