CVE-2024-28752
1 advisory.
Maven/org.apache.cxf:cxf-rt-databinding-aegis CVE-2024-28752: critical 9.3
SSRF vulnerability using the Aegis DataBinding in Apache CXF
Action: Upgrade org.apache.cxf:cxf-rt-databinding-aegis to 3.5.8 (3.5.x), 3.6.3 (3.6.x) or 4.0.4 (4.0.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.5.8 | - |
| 3.6.0 | 3.6.3 | - |
| 4.0.0 | 4.0.4 | - |
Fixed versions
| 3.5.8 | 3.6.3 | 4.0.4 |
Sources
- osv: GHSA-qmgx-j96g-4428
- https://nvd.nist.gov/vuln/detail/CVE-2024-28752
- https://github.com/apache/cxf/commit/d0baeb3ee64c6d7c883bd2f5c4cb0de6b0b5f463
- https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt
- https://github.com/apache/cxf
- https://security.netapp.com/advisory/ntap-20240517-0001
- http://www.openwall.com/lists/oss-security/2024/03/14/3
CVE-2024-28752 · published · modified · JSON