CVE-2024-28752

criticalpriority · track · 11EPSS 0.029 · 87 %ileexploit · PoCDEEUNLRUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

2 exploits · PoC

Likely / severe?

2.93% (87th) EPSS

CVSS 9.8 · critical

Is it mine?

37 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the default databinding) are not impacted.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.4–9.8

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.3criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:Nsecondary · ENISA EU

v3.19.3criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:Nsecondaryexploitability 2.8 · impact 5.8

v3.19.3criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:Nsecondary · OSV

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N/E:Psecondary · CVSS-BT (t0sche)

v3.17.4highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-918USCWE-918USCWE-918USCWE-918US

exploits (2)

Public proof-of-concept and weaponised exploit code.

CyberCTF/vulhub-apache-cxf-cve-2024-28752Vulhub apache-cxf/CVE-2024-28752: Apache CXF Aegis DataBinding SSRF (CVE-2024-28752), run with IsoloomPoC · poc_in_github
ReaJason/CVE-2024-28752Apache CXF SSRF CVE-2024-28752PoC · poc_in_github

affected products (37)

Products and version ranges known to be affected.

IBM FileNet Content Managerall versionscert_bundDEcpe:/a:ibm:filenet_content_manager:-
Oracle Fusion Middleware 11.1.1.5.0all versionscert_bundDEcpe:/a:oracle:fusion_middleware:11.1.1.5.0
Oracle Fusion Middleware 12.2.1.3.0all versionscert_bundDEcpe:/a:oracle:fusion_middleware:12.2.1.3.0
Oracle Fusion Middleware 12.2.1.4.0all versionscert_bundDEcpe:/a:oracle:fusion_middleware:12.2.1.4.0
Oracle Fusion Middleware 14.1.1.0.0all versionscert_bundDEcpe:/a:oracle:fusion_middleware:14.1.1.0.0
Oracle Fusion Middleware 8.5.7all versionscert_bundDEcpe:/a:oracle:fusion_middleware:8.5.7
Ubuntu Linuxall versionscert_bundDEcpe:/o:canonical:ubuntu_linux:-
cPanel cPanel/WHM <132.0.0all versionscert_bundDE
cPanel cPanel/WHM< 132.0.0cert_bundDE
Apache Software Foundation Apache CXFall versionsenisa_euvdEU
Apache Software Foundation Apache CXF0 → 4.0.4, 3.6.3, 3.5.8enisa_euvdEU
Apache Software Foundation CXF≤ 3.5.8fstec_bduRU
Apache Software Foundation CXF≤ 3.6.3fstec_bduRU
Apache Software Foundation CXF≤ 4.0.4fstec_bduRU
Axiom JDK Libercat Certified EE≤ 9.1.3-2fstec_bduRU
Axiom JDK Libercat Certified EE≤ 8.0.16-7fstec_bduRU
ООО «Ред Софт» РЕД ОС≤ 7.3fstec_bduRU
business_activity_monitoringall versionsncsc_nlNLcpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*
communications_asapall versionsncsc_nlNLcpe:2.3:a:oracle:communications_asap:7.4:*:*:*:*:*:*:*
data_integratorall versionsncsc_nlNLcpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*

showing 20 of 37

advisories (7)

Vendor and ecosystem advisories describing this.

NCSC-2024-0294Kwetsbaarheden verholpen in Oracle CommunicationsNL2024-07-17csaf · ncsc_nlNL
Er zijn kwetsbaarheden verholpen in Oracle Communications.
NCSC-2024-0417Kwetsbaarheden verholpen in Oracle Fusion MiddlewareNL2024-10-17csaf · ncsc_nlNL
Oracle heeft kwetsbaarheden verholpen in Fusion Middleware componenten, zoals WebLogic Server, WebCenter en HTTP Server.
WID-SEC-W-2024-0642Apache CXF: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2024-03-14csaf · cert_bundDE
Ein entfernter Angreifer kann eine Schwachstelle in Apache CXF ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
WID-SEC-W-2024-1622Oracle Commerce: Mehrere SchwachstellenDeutsch2024-07-16csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Commerce ausnutzen, um die Vertraulichkeit und Integrität zu gefährden.
WID-SEC-W-2024-1642Oracle Communications: Mehrere SchwachstellenDeutsch2024-07-16csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
WID-SEC-W-2024-3191Oracle Fusion Middleware: Mehrere SchwachstellenDeutsch2024-10-15csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
GHSA-qmgx-j96g-4428SSRF vulnerability using the Aegis DataBinding in Apache CXF2024-03-15ghsa · osvUS
A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the default databinding) are not impacted.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund ncsc_nl osv NVD CVE.org MITRE

published 2024-03-15modified 2026-06-17

references (14)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan