[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAB8XdGBaHXz-XkNidPmuGwep+rkbJitHbtdY0qK86824TMLDog@mail.gmail.com>
Date: Thu, 18 Jul 2024 16:46:10 +0100
From: Colm O hEigeartaigh <coheigea@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2024-29736: Apache CXF: SSRF vulnerability via WADL stylesheet parameter
CVE-2024-29736: SSRF vulnerability via WADL stylesheet parameter
Severity: important
Affected versions:
- Apache CXF before 3.5.9, 3.6.4, 4.0.5
Description:
A SSRF vulnerability in WADL service description in versions of Apache
CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF
style attacks on REST webservices. The attack only applies if a custom
stylesheet parameter is configured.
Credit:
Tobias S. Fink (finder)
References:
https://cxf.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-29736
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
