CVE-2024-28752: SSRF vulnerability using the Aegis DataBinding in Apache CXF
A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the default databinding) are not impacted.
Published Mar 15, 2024 · Updated Feb 2, 2026
Affected packages
org.apache.cxf:cxf-rt-databinding-aegis
- Ecosystem
- Maven
- Affected
- < 3.5.8
- Fixed in
- 3.5.8
- Check
mvn dependency:tree -Dincludes=org.apache.cxf:cxf-rt-databinding-aegis
org.apache.cxf:cxf-rt-databinding-aegis
- Ecosystem
- Maven
- Affected
- >= 3.6.0, < 3.6.3
- Fixed in
- 3.6.3
- Check
mvn dependency:tree -Dincludes=org.apache.cxf:cxf-rt-databinding-aegis
org.apache.cxf:cxf-rt-databinding-aegis
- Ecosystem
- Maven
- Affected
- >= 4.0.0, < 4.0.4
- Fixed in
- 4.0.4
- Check
mvn dependency:tree -Dincludes=org.apache.cxf:cxf-rt-databinding-aegis
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the default databinding) are not impacted.
Credited to johnament.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology