OR
          *cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:* versions up to (excluding) 3.5.8
          *cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:* versions from (including) 3.6.0 up to (excluding) 3.6.3
          *cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:* versions from (including) 4.0.0 up to (excluding) 4.0.4

OR
          *cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
          *cpe:2.3:a:netapp:ontap_tools:10:*:*:*:*:vmware_vsphere:*:*

Apache Software Foundation: http://www.openwall.com/lists/oss-security/2024/03/14/3 Types: Mailing List

Apache Software Foundation: https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt Types: Vendor Advisory

Apache Software Foundation: https://security.netapp.com/advisory/ntap-20240517-0001/ Types: Third Party Advisory

CVE: http://www.openwall.com/lists/oss-security/2024/03/14/3 Types: Mailing List

CVE: https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt Types: Vendor Advisory

CVE: https://security.netapp.com/advisory/ntap-20240517-0001/ Types: Third Party Advisory

A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the default databinding) are not impacted.

A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the default databinding) are not impacted.

http://www.openwall.com/lists/oss-security/2024/03/14/3

https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt

https://security.netapp.com/advisory/ntap-20240517-0001/

CISA-ADP AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

CISA-ADP CWE-918

Apache Software Foundation https://security.netapp.com/advisory/ntap-20240517-0001/ [No types assigned]

Apache Software Foundation http://www.openwall.com/lists/oss-security/2024/03/14/3 [No types assigned]

A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the default databinding) are not impacted.

Apache Software Foundation CWE-918

Apache Software Foundation https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt [No types assigned]