Description
A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache CXF | < 3.5.9, 3.6.4, 4.0.5 | 3.5.9, 3.6.4, 4.0.5 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.cxf:cxf-rt-rs-service-description | >= 4.0.0, < 4.0.5 | 4.0.5 | GHSA-5m3j-pxh7-455p |
| Maven | org.apache.cxf:cxf-rt-rs-service-description | >= 3.6.0, < 3.6.4 | 3.6.4 | GHSA-5m3j-pxh7-455p |
| Maven | org.apache.cxf:cxf-rt-rs-service-description | < 3.5.9 | 3.5.9 | GHSA-5m3j-pxh7-455p |
Advisories 5
- WID-SEC-2026-0351 Dell NetWorker (Third Party Components): Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 31, 2026
- WID-SEC-2024-3195 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- WID-SEC-2024-1678 Apache CXF: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 19, 2026
- NCSC-2024-0418 Kwetsbaarheden verholpen in Oracle Analytics NCSC-NL (Netherlands) · Oct 17, 2024
- NCSC-2024-0414 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Oct 17, 2024
References
- https://lists.apache.org/thread/4jtpsswn2r6xommol54p5mg263ysgdw2 vendor-advisory