Search for vulnerabilities
Vulnerability details: VCID-6b2t-76tu-aaaa
Vulnerability ID VCID-6b2t-76tu-aaaa
Aliases CVE-2024-28752
GHSA-qmgx-j96g-4428
Summary A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the default databinding) are not impacted.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-918 Server-Side Request Forgery (SSRF)
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 7.3 https://access.redhat.com/errata/RHSA-2024:3559
ssvc Track https://access.redhat.com/errata/RHSA-2024:3559
cvssv3.1 7.3 https://access.redhat.com/errata/RHSA-2024:3560
ssvc Track https://access.redhat.com/errata/RHSA-2024:3560
cvssv3.1 7.3 https://access.redhat.com/errata/RHSA-2024:3561
ssvc Track https://access.redhat.com/errata/RHSA-2024:3561
cvssv3.1 7.3 https://access.redhat.com/errata/RHSA-2024:3563
ssvc Track https://access.redhat.com/errata/RHSA-2024:3563
cvssv3 7.4 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-28752.json
epss 0.0005 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.0005 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.0005 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.0005 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.0005 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.0005 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.0005 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00062 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00112 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00128 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00128 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00128 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00128 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00128 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00128 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00128 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00128 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00128 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00128 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00128 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00128 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00128 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00248 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00248 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00248 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00248 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00248 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00248 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00248 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00248 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00248 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00248 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00248 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00248 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00248 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00248 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00248 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00789 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
cvssv3.1 9.3 https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt
generic_textual CRITICAL https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-qmgx-j96g-4428
cvssv3.1 3.7 https://github.com/apache/cxf
generic_textual LOW https://github.com/apache/cxf
cvssv3.1 9.3 https://security.netapp.com/advisory/ntap-20240517-0001
generic_textual CRITICAL https://security.netapp.com/advisory/ntap-20240517-0001
cvssv3.1 9.3 http://www.openwall.com/lists/oss-security/2024/03/14/3
generic_textual CRITICAL http://www.openwall.com/lists/oss-security/2024/03/14/3
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-28752.json
https://api.first.org/data/v1/epss?cve=CVE-2024-28752
https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt
https://github.com/apache/cxf
https://security.netapp.com/advisory/ntap-20240517-0001
https://security.netapp.com/advisory/ntap-20240517-0001/
http://www.openwall.com/lists/oss-security/2024/03/14/3
2270732 https://bugzilla.redhat.com/show_bug.cgi?id=2270732
CVE-2024-28752 https://nvd.nist.gov/vuln/detail/CVE-2024-28752
GHSA-qmgx-j96g-4428 https://github.com/advisories/GHSA-qmgx-j96g-4428
RHSA-2024:10207 https://access.redhat.com/errata/RHSA-2024:10207
RHSA-2024:10208 https://access.redhat.com/errata/RHSA-2024:10208
RHSA-2024:2834 https://access.redhat.com/errata/RHSA-2024:2834
RHSA-2024:2852 https://access.redhat.com/errata/RHSA-2024:2852
RHSA-2024:3354 https://access.redhat.com/errata/RHSA-2024:3354
RHSA-2024:3559 https://access.redhat.com/errata/RHSA-2024:3559
RHSA-2024:3560 https://access.redhat.com/errata/RHSA-2024:3560
RHSA-2024:3561 https://access.redhat.com/errata/RHSA-2024:3561
RHSA-2024:3563 https://access.redhat.com/errata/RHSA-2024:3563
RHSA-2024:3708 https://access.redhat.com/errata/RHSA-2024:3708
RHSA-2024:5479 https://access.redhat.com/errata/RHSA-2024:5479
RHSA-2024:5481 https://access.redhat.com/errata/RHSA-2024:5481
RHSA-2024:5482 https://access.redhat.com/errata/RHSA-2024:5482
RHSA-2024:8339 https://access.redhat.com/errata/RHSA-2024:8339
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://access.redhat.com/errata/RHSA-2024:3559
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-04-09T19:46:50Z/ Found at https://access.redhat.com/errata/RHSA-2024:3559
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://access.redhat.com/errata/RHSA-2024:3560
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-04-09T19:46:50Z/ Found at https://access.redhat.com/errata/RHSA-2024:3560
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://access.redhat.com/errata/RHSA-2024:3561
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-04-09T19:46:50Z/ Found at https://access.redhat.com/errata/RHSA-2024:3561
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://access.redhat.com/errata/RHSA-2024:3563
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-04-09T19:46:50Z/ Found at https://access.redhat.com/errata/RHSA-2024:3563
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-28752.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N Found at https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://github.com/apache/cxf
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N Found at https://security.netapp.com/advisory/ntap-20240517-0001
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N Found at http://www.openwall.com/lists/oss-security/2024/03/14/3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.15195
EPSS Score 0.0005
Published At April 15, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2024-04-23T17:19:20.863452+00:00 NVD Importer Import https://nvd.nist.gov/vuln/detail/CVE-2024-28752 34.0.0rc4