CVE-2022-46363
High
Description
A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, and so the vulnerability can only arise if the CXF service is misconfigured.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Apache Cxf
PublishedDec 13, 2022
First seenDec 13, 2022
Weakness typeCWE-20Improper input validation
How to fix
Update
- apache cxf3.4.10, 3.5.5 or later
- org.apache.cxf:cxf-core3.4.10, 3.5.5 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache cxf | v < 3.4.10, 3.5.0 ≤ v < 3.5.5 | 3.4.10, 3.5.5 |
| org.apache.cxf:cxf-coreMaven | v < 3.4.10, 3.5.0 ≤ v < 3.5.5 | 3.4.10, 3.5.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.