{"action":"Upgrade org.apache.cxf:cxf-rt-databinding-aegis to 3.5.8 (3.5.x), 3.6.3 (3.6.x) or 4.0.4 (4.0.x) or later.","affected":[{"fixed":"3.5.8","introduced":"0"},{"fixed":"3.6.3","introduced":"3.6.0"},{"fixed":"4.0.4","introduced":"4.0.0"}],"component":"org.apache.cxf:cxf-rt-databinding-aegis","cve_ids":["CVE-2024-28752"],"ecosystem":"Maven","epss":0.02925,"exploited":false,"fixed_versions":["3.5.8","3.6.3","4.0.4"],"ghsa_id":"GHSA-qmgx-j96g-4428","id":"tcs_01M5N99T1W3M4ZGPEW50FNQGCH","modified_at":"2026-09-10T03:50:10.871697793Z","published_at":"2024-03-15T12:30:37Z","references":["https://osv.dev/vulnerability/GHSA-qmgx-j96g-4428","https://nvd.nist.gov/vuln/detail/CVE-2024-28752","https://github.com/apache/cxf/commit/d0baeb3ee64c6d7c883bd2f5c4cb0de6b0b5f463","https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt","https://github.com/apache/cxf","https://security.netapp.com/advisory/ntap-20240517-0001","http://www.openwall.com/lists/oss-security/2024/03/14/3"],"severity":{"label":"critical","score":9.3},"sources":[{"source":"osv","source_id":"GHSA-qmgx-j96g-4428","url":"https://osv.dev/vulnerability/GHSA-qmgx-j96g-4428"}],"summary":"SSRF vulnerability using the Aegis DataBinding in Apache CXF"}