Red Hat JBossEAP: Server-Side Request Forgery (SSRF) (CVE-2024-29736)

Red Hat JBossEAP: Server-Side Request Forgery (SSRF) (CVE-2024-29736)

Severity

9

CVSS

(AV:N/AC:L/Au:N/C:C/I:C/A:N)

Published

07/19/2024

Created

09/20/2024

Added

09/19/2024

Modified

09/20/2024

Description

A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured.. A Server-side request forgery (SSRF) vulnerability was found in Apache CXF in the WADL service description. The flaw allows an attacker to perform SSRF-style attacks on REST web services. The attack only applies if a custom stylesheet parameter is configured.

Solution(s)

• red-hat-jboss-eap-upgrade-latest

References

• https://attackerkb.com/topics/cve-2024-29736
• CVE - 2024-29736
• https://access.redhat.com/security/cve/CVE-2024-29736
• https://bugzilla.redhat.com/show_bug.cgi?id=2298827
• https://github.com/advisories/GHSA-5m3j-pxh7-455p
• https://lists.apache.org/thread/4jtpsswn2r6xommol54p5mg263ysgdw2
• https://osv.dev/vulnerability/GHSA-5m3j-pxh7-455p