GHSA-5m3j-pxh7-455p

Suggest an improvement
Source
https://github.com/advisories/GHSA-5m3j-pxh7-455p
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/07/GHSA-5m3j-pxh7-455p/GHSA-5m3j-pxh7-455p.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-5m3j-pxh7-455p
Aliases
Published
2024-07-19T09:32:06Z
Modified
2024-11-22T05:24:50.313306Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
  • 0.0 (None) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Apache CXF: SSRF vulnerability via WADL stylesheet parameter
Details

A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured.

Database specific
{
    "nvd_published_at": "2024-07-19T09:15:04Z",
    "cwe_ids": [
        "CWE-918"
    ],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2024-07-19T18:34:43Z"
}
References

Affected packages

Maven / org.apache.cxf:cxf-rt-rs-service-description

Package

Name
org.apache.cxf:cxf-rt-rs-service-description
View open source insights on deps.dev
Purl
pkg:maven/org.apache.cxf/cxf-rt-rs-service-description

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
4.0.5

Affected versions

4.*

4.0.0
4.0.1
4.0.2
4.0.3
4.0.4

Maven / org.apache.cxf:cxf-rt-rs-service-description

Package

Name
org.apache.cxf:cxf-rt-rs-service-description
View open source insights on deps.dev
Purl
pkg:maven/org.apache.cxf/cxf-rt-rs-service-description

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.6.0
Fixed
3.6.4

Affected versions

3.*

3.6.0
3.6.1
3.6.2
3.6.3

Maven / org.apache.cxf:cxf-rt-rs-service-description

Package

Name
org.apache.cxf:cxf-rt-rs-service-description
View open source insights on deps.dev
Purl
pkg:maven/org.apache.cxf/cxf-rt-rs-service-description

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.5.9

Affected versions

3.*

3.0.0-milestone1
3.0.0-milestone2
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.0.10
3.0.11
3.0.12
3.0.13
3.0.14
3.0.15
3.0.16
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.8
3.2.9
3.2.10
3.2.11
3.2.12
3.2.13
3.2.14
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.3.8
3.3.9
3.3.10
3.3.11
3.3.12
3.3.13
3.4.0
3.4.1
3.4.2
3.4.3
3.4.4
3.4.5
3.4.6
3.4.7
3.4.8
3.4.9
3.4.10
3.5.0
3.5.1
3.5.2
3.5.3
3.5.4
3.5.5
3.5.6
3.5.7
3.5.8