CVE-2024-29736

Published: Jul 19, 2024Modified: Jun 17, 2026

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.2

Source: NVD

Description

A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured.

Affected (3)

Products: Apache: Cxf

Apache

1 product

Cxf

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Apache Cxf	Before 3.5.9
Apache Cxf	From 3.6.0 to 3.6.4
Apache Cxf	From 4.0.0 to 4.0.5

Related CWEs

CWE-918

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (4)

https://lists.apache.org/thread/4jtpsswn2r6xommol54p5mg263ysgdw2

Source: security@apache.org

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2024/07/18/2

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread/4jtpsswn2r6xommol54p5mg263ysgdw2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListVendor Advisory

https://security.netapp.com/advisory/ntap-20241115-0003/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.