Apache CXF: SSRF vulnerability via WADL stylesheet parameter
Moderate severity
GitHub Reviewed
Published
Jul 19, 2024
to the GitHub Advisory Database
•
Updated Aug 2, 2024
Package
Affected versions
>= 4.0.0, < 4.0.5
>= 3.6.0, < 3.6.4
< 3.5.9
Patched versions
4.0.5
3.6.4
3.5.9
Description
Published by the National Vulnerability Database
Jul 19, 2024
Published to the GitHub Advisory Database
Jul 19, 2024
Reviewed
Jul 19, 2024
Last updated
Aug 2, 2024
A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured.
References