Today > 5 Critical | 6 High | 28 Medium vulnerabilities   -   You can now download lists of IOCs here!

CVE-2024-29736

July 19, 2024, 1:01 p.m.

Tags

security@apache.org
CWE-918
2024-07-19
CVE-2024-29736

Product(s) Impacted

Apache CXF

  • before 4.0.5
  • 3.6.4
  • 3.5.9

Description

A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured.

Weaknesses

CWE-918
Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

CWE ID: 918

Date

Published: July 19, 2024, 9:15 a.m.

Last Modified: July 19, 2024, 1:01 p.m.

Status : Undergoing Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

security@apache.org

References

https://lists.apache.org/ security@apache.org