# Vulnerability detected on Search-guard -7 **URL:** \ **Category:** Search Guard\ **Created:** [September 3, 2024, 5:19am UTC](https://forum.search-guard.com/t/vulnerability-detected-on-search-guard-7/4473 "2024-09-03T05:19:59Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Reshmi](https://avatars.discourse-cdn.com/v4/letter/r/87869e/32.png) [@Reshmi](https://forum.search-guard.com/u/Reshmi)\ **Post date:** [September 3, 2024, 5:19am UTC](https://forum.search-guard.com/t/vulnerability-detected-on-search-guard-7/4473/1 "2024-09-03T05:19:59Z")
The version of Apache CXF installed on the remote Windows host is affected by multiple vulnerabilities: - A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured. (CVE-2024-29736) Path : /app/softwareagwM1011/InternalDataStore/plugins/search-guard-7/cxf-core-3.3.7.jar Installed version : 3.3.7 Fixed version : 3.5.9 ElasticSearch version- 7.13.0 Could you please provide the status of these findings, or information about mitigation/remediation ---
**Author:** ![sirHusky](https://avatars.discourse-cdn.com/v4/letter/s/e9a140/32.png) [@sirHusky](https://forum.search-guard.com/u/sirHusky)\ **Post date:** [September 3, 2024, 12:45pm UTC](https://forum.search-guard.com/t/vulnerability-detected-on-search-guard-7/4473/2 "2024-09-03T12:45:29Z")
@rashmi Thank you for reporting this, can you please confirm which version of SG you are using? ---
**Author:** ![Reshmi](https://avatars.discourse-cdn.com/v4/letter/r/87869e/32.png) [@Reshmi](https://forum.search-guard.com/u/Reshmi)\ **Post date:** [September 3, 2024, 1:37pm UTC](https://forum.search-guard.com/t/vulnerability-detected-on-search-guard-7/4473/3 "2024-09-03T13:37:06Z")
We are using Search Guard 7.13 version. Wanted to know if this version is actually affected by this CVE or not ---
**Author:** ![sirHusky](https://avatars.discourse-cdn.com/v4/letter/s/e9a140/32.png) [@sirHusky](https://forum.search-guard.com/u/sirHusky)\ **Post date:** [September 3, 2024, 2:37pm UTC](https://forum.search-guard.com/t/vulnerability-detected-on-search-guard-7/4473/4 "2024-09-03T14:37:32Z")
@Reshmi The above is elasticsearch version. Can you confirm the version of SG, see the SG version matrix [https://docs.search-guard.com/latest/search-guard-versions](https://docs.search-guard.com/latest/search-guard-versions) ---
**Author:** ![Reshmi](https://avatars.discourse-cdn.com/v4/letter/r/87869e/32.png) [@Reshmi](https://forum.search-guard.com/u/Reshmi)\ **Post date:** [September 4, 2024, 5:34am UTC](https://forum.search-guard.com/t/vulnerability-detected-on-search-guard-7/4473/5 "2024-09-04T05:34:12Z")
dear @sirHusky , We are using SG 51.0.0 version ---
**Author:** ![sirHusky](https://avatars.discourse-cdn.com/v4/letter/s/e9a140/32.png) [@sirHusky](https://forum.search-guard.com/u/sirHusky)\ **Post date:** [September 4, 2024, 3:58pm UTC](https://forum.search-guard.com/t/vulnerability-detected-on-search-guard-7/4473/6 "2024-09-04T15:58:13Z")
@Reshmi As you are using EOL version, I would recommend to upgrade to the active/supported version, where the fix with latest libraries will be provided. Also since you are using SG classic, it would be highly recommended to upgrade to SearchGuard FLX as this version is actively being developed and updated with latest libraries. Hope this helps ---
**Author:** ![Reshmi](https://avatars.discourse-cdn.com/v4/letter/r/87869e/32.png) [@Reshmi](https://forum.search-guard.com/u/Reshmi)\ **Post date:** [September 5, 2024, 3:58am UTC](https://forum.search-guard.com/t/vulnerability-detected-on-search-guard-7/4473/7 "2024-09-05T03:58:10Z")
@sirHusky , Sure , we will plan for the upgrade. but until then , is it possible to confirm if this current version of SG is impacted by this CVE ? ---
**Author:** ![Reshmi](https://avatars.discourse-cdn.com/v4/letter/r/87869e/32.png) [@Reshmi](https://forum.search-guard.com/u/Reshmi)\ **Post date:** [September 10, 2024, 6:33am UTC](https://forum.search-guard.com/t/vulnerability-detected-on-search-guard-7/4473/8 "2024-09-10T06:33:57Z")
@sirHusky , Kindly let us know if this version of SG is impacted by this CVE ---
**Author:** ![sirHusky](https://avatars.discourse-cdn.com/v4/letter/s/e9a140/32.png) [@sirHusky](https://forum.search-guard.com/u/sirHusky)\ **Post date:** [September 10, 2024, 12:48pm UTC](https://forum.search-guard.com/t/vulnerability-detected-on-search-guard-7/4473/9 "2024-09-10T12:48:14Z")
@Reshmi the previous may have been effected, but the latest SG classic version 53.10.0 is updated to use the latest libraries. You can find the version on the [SearchGuard versions page](https://docs.search-guard.com/latest/search-guard-versions) or download it directly using [link](https://maven.search-guard.com/search-guard-suite-release/com/floragunn/search-guard-suite-plugin/7.17.23-53.10.0/search-guard-suite-plugin-7.17.23-53.10.0.zip). Hope this helps ---
**Author:** ![system](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/system/32/1870_2.png) [@system](https://forum.search-guard.com/u/system)\ **Post date:** [October 1, 2024, 12:48pm UTC](https://forum.search-guard.com/t/vulnerability-detected-on-search-guard-7/4473/10 "2024-10-01T12:48:47Z")
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.