CVE-2024-28752

CriticalPublished

Apache CXF SSRF Vulnerability using the Aegis databinding

Published: Mar 15, 2024
Updated: Feb 13, 2025
Assigning CNA: apache
Evidence observed: Aug 5, 2026

Primary CVSS

9.3/ 10Critical

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

EPSS probability estimate

2.5%

Low · next 30 days

Percentile: 84.2%
Model date: Oct 17, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the default databinding) are not impacted.

Sources

Repository evidence: Files: 1 · Repositories: 1

1 Lab

Apache CXF Aegis DataBinding Server-Side Request ForgeryLab
apache-cxf/CVE-2024-28752
Apache CXF Aegis DataBinding Server-Side Request Forgery (CVE-2024-28752)
Vulhub vulnerability labs
ResearchEvidence observed: Sep 25, 2026Revision: 9b90d4276f84Related tool
Declared conditions
- lab image version: vulhub/apache-cxf:3.2.14(apache-cxf/CVE-2024-28752/docker-compose.yml:services.cxf.image)

CVE-2024-28752PoC
Apache CXF SSRF CVE-2024-28752

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.