CVE-2024-28752 — Apache CXF SSRF Vulnerability using the Aegis databinding

Back Back to CVE browser

CRITICAL

Apache CXF SSRF Vulnerability using the Aegis databinding

Published Mar 15, 2024

9.3

CRITICAL

CVSS 4.0

EPSS 2.47%

Description

A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the default databinding) are not impacted.

Affected products

Vendor Apache Software Foundation Product Apache CXF Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <4.0.4, 3.6.3, 3.5.8

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Apache Software Foundation

Apache CXF

unaffected

Version	Status	Constraints
0	affected	<4.0.4, 3.6.3, 3.5.8

Vendor Apache Product Cxf Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <3.5.8
- Version
  0
  Status
  affected
  Constraints
  <3.6.3
- Version
  0
  Status
  affected
  Constraints
  <4.0.4
Vendor NetApp Product Oncommand Workflow Automation Default
n/a
- Version
  0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Apache

Cxf

unaffected

Version	Status	Constraints
0	affected	<3.5.8
0	affected	<3.6.3
0	affected	<4.0.4

NetApp

Oncommand Workflow Automation

n/a

Version	Status	Constraints
0	affected	-

RHINT Camel-K 1.10.8

cxf-core

Fixed · RHSA-2024:8339
Red Hat Fuse 7.13.0

cxf-core

Fixed · RHSA-2024:3354
Red Hat JBoss Enterprise Application Platform

org.apache.cxf/cxf-core:3.5.8.redhat-00001

Fixed · RHSA-2024:3563
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7

Fixed · RHSA-2024:10208
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7

Fixed · RHSA-2024:10208
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7

Fixed · RHSA-2024:10208
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7

Fixed · RHSA-2024:10208
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7

Fixed · RHSA-2024:10208
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7

Fixed · RHSA-2024:10208
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7

Fixed · RHSA-2024:10208
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7

Fixed · RHSA-2024:10208
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7

Fixed · RHSA-2024:10208
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

eap7-apache-cxf-0:3.4.10-1.SP1_redhat_00001.1.el7eap

Fixed · RHSA-2024:10207
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

eap7-avro-0:1.7.6-8.redhat_00003.1.el7eap

Fixed · RHSA-2024:10207
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

eap7-h2database-0:1.4.197-3.redhat_00004.1.el7eap

Fixed · RHSA-2024:10207
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

eap7-jboss-annotations-api_1.3_spec-0:2.0.1-4.Final_redhat_00001.1.el7eap

Fixed · RHSA-2024:10207
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.el7eap

Fixed · RHSA-2024:10207
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

eap7-jboss-server-migration-0:1.7.2-12.Final_redhat_00013.1.el7eap

Fixed · RHSA-2024:10207
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

eap7-jboss-xnio-base-0:3.7.13-1.Final_redhat_00001.1.el7eap

Fixed · RHSA-2024:10207
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

eap7-log4j-jboss-logmanager-0:1.2.2-2.Final_redhat_00002.1.el7eap

Fixed · RHSA-2024:10207
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

eap7-wildfly-0:7.3.11-4.GA_redhat_00002.1.el7eap

Fixed · RHSA-2024:10207
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

eap7-wss4j-0:2.3.3-2.redhat_00001.1.el7eap

Fixed · RHSA-2024:10207
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

eap7-xalan-j2-0:2.7.1-38.redhat_00015.1.el7eap

Fixed · RHSA-2024:10207
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

eap7-xml-security-0:2.2.3-2.redhat_00001.1.el7eap

Fixed · RHSA-2024:10207
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

eap7-apache-cxf-0:3.5.8-1.redhat_00001.1.el8eap

Fixed · RHSA-2024:3560
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

eap7-hal-console-0:3.3.22-1.Final_redhat_00001.1.el8eap

Fixed · RHSA-2024:3560
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

eap7-infinispan-0:11.0.19-2.Final_redhat_00001.1.el8eap

Fixed · RHSA-2024:3560
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

eap7-jboss-ejb-client-0:4.0.54-3.Final_redhat_00001.1.el8eap

Fixed · RHSA-2024:3560
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

eap7-jboss-jsf-api_2.3_spec-0:3.0.0-8.SP08_redhat_00001.1.el8eap

Fixed · RHSA-2024:3560
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

eap7-jboss-metadata-0:13.5.0-1.Final_redhat_00001.1.el8eap

Fixed · RHSA-2024:3560
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

eap7-jboss-modules-0:1.12.3-3.Final_redhat_00001.1.el8eap

Fixed · RHSA-2024:3560
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

eap7-jboss-server-migration-0:1.10.0-36.Final_redhat_00035.1.el8eap

Fixed · RHSA-2024:3560
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

eap7-undertow-0:2.2.32-1.SP1_redhat_00001.1.el8eap

Fixed · RHSA-2024:3560
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

eap7-wildfly-0:7.4.17-2.GA_redhat_00002.1.el8eap

Fixed · RHSA-2024:3560
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

eap7-wildfly-discovery-0:1.2.4-1.Final_redhat_00001.1.el8eap

Fixed · RHSA-2024:3560
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

eap7-wildfly-elytron-0:1.15.23-2.Final_redhat_00001.1.el8eap

Fixed · RHSA-2024:3560
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

eap7-wildfly-http-client-0:1.1.17-1.Final_redhat_00002.1.el8eap

Fixed · RHSA-2024:3560
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

eap7-wildfly-transaction-client-0:1.1.19-1.Final_redhat_00001.1.el8eap

Fixed · RHSA-2024:3560
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

eap7-wss4j-0:2.4.3-1.redhat_00001.1.el8eap

Fixed · RHSA-2024:3560
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

eap7-xml-security-0:2.3.4-1.redhat_00002.1.el8eap

Fixed · RHSA-2024:3560
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

eap7-apache-cxf-0:3.5.8-1.redhat_00001.1.el9eap

Fixed · RHSA-2024:3561
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

eap7-hal-console-0:3.3.22-1.Final_redhat_00001.1.el9eap

Fixed · RHSA-2024:3561
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

eap7-infinispan-0:11.0.19-2.Final_redhat_00001.1.el9eap

Fixed · RHSA-2024:3561
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

eap7-jboss-ejb-client-0:4.0.54-3.Final_redhat_00001.1.el9eap

Fixed · RHSA-2024:3561
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

eap7-jboss-jsf-api_2.3_spec-0:3.0.0-8.SP08_redhat_00001.1.el9eap

Fixed · RHSA-2024:3561
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

eap7-jboss-metadata-0:13.5.0-1.Final_redhat_00001.1.el9eap

Fixed · RHSA-2024:3561
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

eap7-jboss-modules-0:1.12.3-3.Final_redhat_00001.1.el9eap

Fixed · RHSA-2024:3561
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

eap7-jboss-server-migration-0:1.10.0-36.Final_redhat_00035.1.el9eap

Fixed · RHSA-2024:3561
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

eap7-undertow-0:2.2.32-1.SP1_redhat_00001.1.el9eap

Fixed · RHSA-2024:3561
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

eap7-wildfly-0:7.4.17-2.GA_redhat_00002.1.el9eap

Fixed · RHSA-2024:3561
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

eap7-wildfly-discovery-0:1.2.4-1.Final_redhat_00001.1.el9eap

Fixed · RHSA-2024:3561
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

eap7-wildfly-elytron-0:1.15.23-2.Final_redhat_00001.1.el9eap

Fixed · RHSA-2024:3561
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

eap7-wildfly-http-client-0:1.1.17-1.Final_redhat_00002.1.el9eap

Fixed · RHSA-2024:3561
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

eap7-wildfly-transaction-client-0:1.1.19-1.Final_redhat_00001.1.el9eap

Fixed · RHSA-2024:3561
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

eap7-wss4j-0:2.4.3-1.redhat_00001.1.el9eap

Fixed · RHSA-2024:3561
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

eap7-xml-security-0:2.3.4-1.redhat_00002.1.el9eap

Fixed · RHSA-2024:3561
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

eap7-apache-cxf-0:3.5.8-1.redhat_00001.1.el7eap

Fixed · RHSA-2024:3559
Red Hat JBoss Enterprise Application Platform 8

cxf-core

Fixed · RHSA-2024:5482
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

eap8-apache-cxf-0:4.0.4-1.redhat_00001.1.el8eap

Fixed · RHSA-2024:5479
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

eap8-apache-cxf-xjc-utils-0:4.0.0-5.redhat_00003.1.el8eap

Fixed · RHSA-2024:5479
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

eap8-apache-cxf-0:4.0.4-1.redhat_00001.1.el9eap

Fixed · RHSA-2024:5481
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

eap8-apache-cxf-xjc-utils-0:4.0.0-5.redhat_00003.1.el9eap

Fixed · RHSA-2024:5481
Red Hat build of Apache Camel 3.20.6 for Spring Boot

n/a

Fixed · RHSA-2024:3708
Red Hat build of Apache Camel 4 for Quarkus 3

n/a

Fixed · RHSA-2024:2852
Red Hat build of Apache Camel 4 for Quarkus 3

n/a

Fixed · RHSA-2024:2834
Logging Subsystem for Red Hat OpenShift

com.amazon.opendistroforelasticsearch-opendistro_security

Not affected
Red Hat Build of Keycloak

cxf-core

Not affected
Red Hat Data Grid 8

cxf-core

Not affected
Red Hat JBoss Data Grid 7

cxf-core

Out of support scope
Red Hat JBoss Enterprise Application Platform Expansion Pack

cxf-core

Not affected
Red Hat Process Automation 7

cxf-core

Not affected
Red Hat Single Sign-On 7

cxf-core

Fix deferred
streams for Apache Kafka

cxf-core

Not affected

Product	Package	State	Advisory
RHINT Camel-K 1.10.8	cxf-core	Fixed	RHSA-2024:8339
Red Hat Fuse 7.13.0	cxf-core	Fixed	RHSA-2024:3354
Red Hat JBoss Enterprise Application Platform	org.apache.cxf/cxf-core:3.5.8.redhat-00001	Fixed	RHSA-2024:3563
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7	eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7	Fixed	RHSA-2024:10208
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7	eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7	Fixed	RHSA-2024:10208
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7	eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7	Fixed	RHSA-2024:10208
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7	eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7	Fixed	RHSA-2024:10208
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7	eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7	Fixed	RHSA-2024:10208
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7	eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7	Fixed	RHSA-2024:10208
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7	eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7	Fixed	RHSA-2024:10208
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7	eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7	Fixed	RHSA-2024:10208
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7	eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7	Fixed	RHSA-2024:10208
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7	eap7-apache-cxf-0:3.4.10-1.SP1_redhat_00001.1.el7eap	Fixed	RHSA-2024:10207
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7	eap7-avro-0:1.7.6-8.redhat_00003.1.el7eap	Fixed	RHSA-2024:10207
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7	eap7-h2database-0:1.4.197-3.redhat_00004.1.el7eap	Fixed	RHSA-2024:10207
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7	eap7-jboss-annotations-api_1.3_spec-0:2.0.1-4.Final_redhat_00001.1.el7eap	Fixed	RHSA-2024:10207
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7	eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.el7eap	Fixed	RHSA-2024:10207
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7	eap7-jboss-server-migration-0:1.7.2-12.Final_redhat_00013.1.el7eap	Fixed	RHSA-2024:10207
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7	eap7-jboss-xnio-base-0:3.7.13-1.Final_redhat_00001.1.el7eap	Fixed	RHSA-2024:10207
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7	eap7-log4j-jboss-logmanager-0:1.2.2-2.Final_redhat_00002.1.el7eap	Fixed	RHSA-2024:10207
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7	eap7-wildfly-0:7.3.11-4.GA_redhat_00002.1.el7eap	Fixed	RHSA-2024:10207
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7	eap7-wss4j-0:2.3.3-2.redhat_00001.1.el7eap	Fixed	RHSA-2024:10207
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7	eap7-xalan-j2-0:2.7.1-38.redhat_00015.1.el7eap	Fixed	RHSA-2024:10207
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7	eap7-xml-security-0:2.2.3-2.redhat_00001.1.el7eap	Fixed	RHSA-2024:10207
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8	eap7-apache-cxf-0:3.5.8-1.redhat_00001.1.el8eap	Fixed	RHSA-2024:3560
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8	eap7-hal-console-0:3.3.22-1.Final_redhat_00001.1.el8eap	Fixed	RHSA-2024:3560
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8	eap7-infinispan-0:11.0.19-2.Final_redhat_00001.1.el8eap	Fixed	RHSA-2024:3560
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8	eap7-jboss-ejb-client-0:4.0.54-3.Final_redhat_00001.1.el8eap	Fixed	RHSA-2024:3560
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8	eap7-jboss-jsf-api_2.3_spec-0:3.0.0-8.SP08_redhat_00001.1.el8eap	Fixed	RHSA-2024:3560
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8	eap7-jboss-metadata-0:13.5.0-1.Final_redhat_00001.1.el8eap	Fixed	RHSA-2024:3560
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8	eap7-jboss-modules-0:1.12.3-3.Final_redhat_00001.1.el8eap	Fixed	RHSA-2024:3560
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8	eap7-jboss-server-migration-0:1.10.0-36.Final_redhat_00035.1.el8eap	Fixed	RHSA-2024:3560
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8	eap7-undertow-0:2.2.32-1.SP1_redhat_00001.1.el8eap	Fixed	RHSA-2024:3560
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8	eap7-wildfly-0:7.4.17-2.GA_redhat_00002.1.el8eap	Fixed	RHSA-2024:3560
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8	eap7-wildfly-discovery-0:1.2.4-1.Final_redhat_00001.1.el8eap	Fixed	RHSA-2024:3560
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8	eap7-wildfly-elytron-0:1.15.23-2.Final_redhat_00001.1.el8eap	Fixed	RHSA-2024:3560
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8	eap7-wildfly-http-client-0:1.1.17-1.Final_redhat_00002.1.el8eap	Fixed	RHSA-2024:3560
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8	eap7-wildfly-transaction-client-0:1.1.19-1.Final_redhat_00001.1.el8eap	Fixed	RHSA-2024:3560
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8	eap7-wss4j-0:2.4.3-1.redhat_00001.1.el8eap	Fixed	RHSA-2024:3560
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8	eap7-xml-security-0:2.3.4-1.redhat_00002.1.el8eap	Fixed	RHSA-2024:3560
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9	eap7-apache-cxf-0:3.5.8-1.redhat_00001.1.el9eap	Fixed	RHSA-2024:3561
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9	eap7-hal-console-0:3.3.22-1.Final_redhat_00001.1.el9eap	Fixed	RHSA-2024:3561
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9	eap7-infinispan-0:11.0.19-2.Final_redhat_00001.1.el9eap	Fixed	RHSA-2024:3561
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9	eap7-jboss-ejb-client-0:4.0.54-3.Final_redhat_00001.1.el9eap	Fixed	RHSA-2024:3561
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9	eap7-jboss-jsf-api_2.3_spec-0:3.0.0-8.SP08_redhat_00001.1.el9eap	Fixed	RHSA-2024:3561
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9	eap7-jboss-metadata-0:13.5.0-1.Final_redhat_00001.1.el9eap	Fixed	RHSA-2024:3561
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9	eap7-jboss-modules-0:1.12.3-3.Final_redhat_00001.1.el9eap	Fixed	RHSA-2024:3561
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9	eap7-jboss-server-migration-0:1.10.0-36.Final_redhat_00035.1.el9eap	Fixed	RHSA-2024:3561
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9	eap7-undertow-0:2.2.32-1.SP1_redhat_00001.1.el9eap	Fixed	RHSA-2024:3561
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9	eap7-wildfly-0:7.4.17-2.GA_redhat_00002.1.el9eap	Fixed	RHSA-2024:3561
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9	eap7-wildfly-discovery-0:1.2.4-1.Final_redhat_00001.1.el9eap	Fixed	RHSA-2024:3561
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9	eap7-wildfly-elytron-0:1.15.23-2.Final_redhat_00001.1.el9eap	Fixed	RHSA-2024:3561
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9	eap7-wildfly-http-client-0:1.1.17-1.Final_redhat_00002.1.el9eap	Fixed	RHSA-2024:3561
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9	eap7-wildfly-transaction-client-0:1.1.19-1.Final_redhat_00001.1.el9eap	Fixed	RHSA-2024:3561
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9	eap7-wss4j-0:2.4.3-1.redhat_00001.1.el9eap	Fixed	RHSA-2024:3561
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9	eap7-xml-security-0:2.3.4-1.redhat_00002.1.el9eap	Fixed	RHSA-2024:3561
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7	eap7-apache-cxf-0:3.5.8-1.redhat_00001.1.el7eap	Fixed	RHSA-2024:3559
Red Hat JBoss Enterprise Application Platform 8	cxf-core	Fixed	RHSA-2024:5482
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8	eap8-apache-cxf-0:4.0.4-1.redhat_00001.1.el8eap	Fixed	RHSA-2024:5479
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8	eap8-apache-cxf-xjc-utils-0:4.0.0-5.redhat_00003.1.el8eap	Fixed	RHSA-2024:5479
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9	eap8-apache-cxf-0:4.0.4-1.redhat_00001.1.el9eap	Fixed	RHSA-2024:5481
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9	eap8-apache-cxf-xjc-utils-0:4.0.0-5.redhat_00003.1.el9eap	Fixed	RHSA-2024:5481
Red Hat build of Apache Camel 3.20.6 for Spring Boot	n/a	Fixed	RHSA-2024:3708
Red Hat build of Apache Camel 4 for Quarkus 3	n/a	Fixed	RHSA-2024:2852
Red Hat build of Apache Camel 4 for Quarkus 3	n/a	Fixed	RHSA-2024:2834
Logging Subsystem for Red Hat OpenShift	com.amazon.opendistroforelasticsearch-opendistro_security	Not affected	n/a
Red Hat Build of Keycloak	cxf-core	Not affected	n/a
Red Hat Data Grid 8	cxf-core	Not affected	n/a
Red Hat JBoss Data Grid 7	cxf-core	Out of support scope	n/a
Red Hat JBoss Enterprise Application Platform Expansion Pack	cxf-core	Not affected	n/a
Red Hat Process Automation 7	cxf-core	Not affected	n/a
Red Hat Single Sign-On 7	cxf-core	Fix deferred	n/a
streams for Apache Kafka	cxf-core	Not affected	n/a

Remediation

Red Hat statement

Red Hat rates this as an Important impact due to the fact this requires Aegis databind, which is not the default databinding for Apache CXF.

Red Hat mitigation

No mitigation is currently available for this vulnerability. Please make sure to update as the fixes become available.

Metrics

2.47% 0.02468

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.02468

Score over time

2024–2026

EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v3
EPSS v4
EPSS v5

Table of values (15 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	2.47% (0.02468)	83.92th	v5 (v2026.06.15)
Aug 5, 2026	2.47% (0.02468)	82.92th	v5 (v2026.06.15)
Jun 15, 2026	5.85% (0.05849)	92.21th	v5 (v2026.06.15)
Jun 12, 2026	46.60% (0.46602)	97.74th	v4 (v2025.03.14)
May 4, 2026	50.83% (0.50829)	97.88th	v4 (v2025.03.14)
Apr 28, 2026	49.27% (0.49265)	97.79th	v4 (v2025.03.14)
Apr 21, 2026	46.50% (0.46497)	97.67th	v4 (v2025.03.14)
Apr 16, 2026	57.14% (0.57136)	98.15th	v4 (v2025.03.14)
Apr 7, 2026	55.15% (0.55152)	98.05th	v4 (v2025.03.14)
Nov 21, 2025	0.42% (0.00422)	61.33th	v4 (v2025.03.14)
Nov 18, 2025	1.83% (0.01830)	81.43th	v4 (v2025.03.14)
Mar 17, 2025	0.25% (0.00248)	46.15th	v4 (v2025.03.14)
Dec 12, 2024	0.06% (0.00062)	28.22th	v3 (v2023.03.01)
Jun 11, 2024	0.06% (0.00062)	26.20th	v3 (v2023.03.01)
Mar 16, 2024	0.04% (0.00043)	7.22th	v3 (v2023.03.01)

Weaknesses (1)

CWE-918

SSRF

References (9)

http://www.openwall.com/lists/oss-security/2024/03/14/3
Mailing List
https://access.redhat.com/security/cve/CVE-2024-28752
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2270732
Issue Tracking
https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt
vendor-advisoryVendor Advisory
https://github.com/advisories/GHSA-qmgx-j96g-4428
Advisory
https://github.com/apache/cxf/commit/d0baeb3ee64c6d7c883bd2f5c4cb0de6b0b5f463
https://nvd.nist.gov/vuln/detail/CVE-2024-28752
https://security.netapp.com/advisory/ntap-20240517-0001
Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2024-28752

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2024/03/14/3		Mailing List
https://access.redhat.com/security/cve/CVE-2024-28752		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2270732		Issue Tracking
https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt		vendor-advisoryVendor Advisory
https://github.com/advisories/GHSA-qmgx-j96g-4428		Advisory
https://github.com/apache/cxf/commit/d0baeb3ee64c6d7c883bd2f5c4cb0de6b0b5f463
https://nvd.nist.gov/vuln/detail/CVE-2024-28752
https://security.netapp.com/advisory/ntap-20240517-0001		Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2024-28752