Search for vulnerabilities
Vulnerability details: VCID-ekqt-kjy4-xuay
Vulnerability ID VCID-ekqt-kjy4-xuay
Aliases CVE-2024-28752
GHSA-qmgx-j96g-4428
Summary SSRF vulnerability using the Aegis DataBinding in Apache CXF A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the default databinding) are not impacted.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-918 Server-Side Request Forgery (SSRF)
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.4 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-28752.json
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00362 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00362 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00362 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00362 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00362 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00362 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00362 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00362 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00362 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00362 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00362 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00362 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00362 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00362 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00362 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00362 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00362 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00362 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00362 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00362 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00372 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00372 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00372 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
epss 0.00372 https://api.first.org/data/v1/epss?cve=CVE-2024-28752
cvssv3.1 9.3 https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt
generic_textual CRITICAL https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt
ssvc Track https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-qmgx-j96g-4428
cvssv3.1 9.3 https://github.com/apache/cxf
generic_textual CRITICAL https://github.com/apache/cxf
cvssv3.1 9.3 https://nvd.nist.gov/vuln/detail/CVE-2024-28752
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2024-28752
cvssv3.1 9.3 https://security.netapp.com/advisory/ntap-20240517-0001
generic_textual CRITICAL https://security.netapp.com/advisory/ntap-20240517-0001
cvssv3.1 9.3 https://security.netapp.com/advisory/ntap-20240517-0001/
ssvc Track https://security.netapp.com/advisory/ntap-20240517-0001/
cvssv3.1 9.3 http://www.openwall.com/lists/oss-security/2024/03/14/3
generic_textual CRITICAL http://www.openwall.com/lists/oss-security/2024/03/14/3
ssvc Track http://www.openwall.com/lists/oss-security/2024/03/14/3
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-28752.json
https://api.first.org/data/v1/epss?cve=CVE-2024-28752
https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt
https://github.com/apache/cxf
https://nvd.nist.gov/vuln/detail/CVE-2024-28752
https://security.netapp.com/advisory/ntap-20240517-0001
http://www.openwall.com/lists/oss-security/2024/03/14/3
2270732 https://bugzilla.redhat.com/show_bug.cgi?id=2270732
cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_tools:10:*:*:*:*:vmware_vsphere:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:ontap_tools:10:*:*:*:*:vmware_vsphere:*:*
GHSA-qmgx-j96g-4428 https://github.com/advisories/GHSA-qmgx-j96g-4428
ntap-20240517-0001 https://security.netapp.com/advisory/ntap-20240517-0001/
RHSA-2024:2834 https://access.redhat.com/errata/RHSA-2024:2834
RHSA-2024:2852 https://access.redhat.com/errata/RHSA-2024:2852
RHSA-2024:3708 https://access.redhat.com/errata/RHSA-2024:3708
RHSA-2024:5479 https://access.redhat.com/errata/RHSA-2024:5479
RHSA-2024:5481 https://access.redhat.com/errata/RHSA-2024:5481
RHSA-2024:5482 https://access.redhat.com/errata/RHSA-2024:5482
RHSA-2024:8339 https://access.redhat.com/errata/RHSA-2024:8339
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-28752.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N Found at https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-20T03:55:33Z/ Found at https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N Found at https://github.com/apache/cxf
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-28752
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N Found at https://security.netapp.com/advisory/ntap-20240517-0001
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N Found at https://security.netapp.com/advisory/ntap-20240517-0001/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-20T03:55:33Z/ Found at https://security.netapp.com/advisory/ntap-20240517-0001/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N Found at http://www.openwall.com/lists/oss-security/2024/03/14/3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-20T03:55:33Z/ Found at http://www.openwall.com/lists/oss-security/2024/03/14/3
Exploit Prediction Scoring System (EPSS)
Percentile 0.50558
EPSS Score 0.00274
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:33:23.297936+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/03/GHSA-qmgx-j96g-4428/GHSA-qmgx-j96g-4428.json 37.0.0