| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.cxf:cxf-rt-rs-service-description | ≥ 3.6.0, < 3.6.4≥ 4.0.0, < 4.0.5< 3.5.9 | 3.6.44.0.53.5.9 |
| cxf | ≥ 3.6.0, < 3.6.4≥ 4.0.0, < 4.0.5< 3.5.9 | 3.6.44.0.53.5.9 |
A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free