# CVE-2024-28752 vulnerability in opensearch

**URL:** <https://forum.opensearch.org/t/cve-2024-28752-vulnerability-in-opensearch/21481>\
**Category:** Security\
**Tags:** cve, security-issue\
**Created:** [September 16, 2024, 1:25pm UTC](https://forum.opensearch.org/t/cve-2024-28752-vulnerability-in-opensearch/21481 "2024-09-16T13:25:34Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bhupendra](https://avatars.discourse-cdn.com/v4/letter/b/87869e/32.png) [@Bhupendra](https://forum.opensearch.org/u/Bhupendra)\
**Post date:** [September 16, 2024, 1:25pm UTC](https://forum.opensearch.org/t/cve-2024-28752-vulnerability-in-opensearch/21481/1 "2024-09-16T13:25:34Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):  
Opensearch 2.13.0

**Describe the issue** :  
A client of ours, reported vulnerability CVE-2024-28752 in opensearch-security/cxf-core-4.0.3.jar

**Configuration** :

**Relevant Logs or Screenshots** :  
[https://nvd.nist.gov/vuln/detail/CVE-2024-28752](https://nvd.nist.gov/vuln/detail/CVE-2024-28752)

Could you please help me understand if the vulnerability is exploitable?

---

<div class="post-metadata">

**Author:** ![landon\_lslc](https://avatars.discourse-cdn.com/v4/letter/l/96bed5/32.png) [@landon\_lslc](https://forum.opensearch.org/u/landon_lslc)\
**Post date:** [September 18, 2024, 3:12pm UTC](https://forum.opensearch.org/t/cve-2024-28752-vulnerability-in-opensearch/21481/2 "2024-09-18T15:12:14Z")

</div>

Please see the [Security tab on GitHub](https://github.com/opensearch-project/OpenSearch?tab=security-ov-file) for how to report security issues. They generally like to avoid keeping these public until they’re solved.

Currently it says:

> If you discover a potential security issue in this project we ask that you notify OpenSearch Security directly via email to [security@opensearch.org](mailto:security@opensearch.org). Please do **not** create a public GitHub issue.

---

<div class="post-metadata">

**Author:** ![Bhupendra](https://avatars.discourse-cdn.com/v4/letter/b/87869e/32.png) [@Bhupendra](https://forum.opensearch.org/u/Bhupendra)\
**Post date:** [September 19, 2024, 5:10am UTC](https://forum.opensearch.org/t/cve-2024-28752-vulnerability-in-opensearch/21481/3 "2024-09-19T05:10:38Z")

</div>

Thankyou @landon_lslc for your response. Will mail them.