CVE-2022-46363
Apache CXF directory listing / code exfiltration
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, and so the vulnerability can only arise if the CXF service is misconfigured.
Una vulnerabilidad en Apache CXF anterior a las versiones 3.5.5 y 3.4.10 permite a un atacante realizar un listado de directorio remoto o una filtración de código. La vulnerabilidad solo se aplica cuando CXFServlet está configurado con los atributos estático-recursos-lista y redirección-query-check. Se supone que estos atributos no deben usarse juntos, por lo que la vulnerabilidad solo puede surgir si el servicio CXF está mal configurado.
A vulnerability was found in Apache CXF that could allow an attacker to perform a remote directory listing or code exfiltration. This issue only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, so the issue can only occur if the CXF service is misconfigured.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-12-02 CVE Reserved
- 2022-12-13 CVE Published
- 2024-05-25 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
CAPEC
References (3)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c | 2023-11-07 | |
https://access.redhat.com/security/cve/CVE-2022-46363 | 2023-06-29 | |
https://bugzilla.redhat.com/show_bug.cgi?id=2155681 | 2023-06-29 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Apache Search vendor "Apache" | Cxf Search vendor "Apache" for product "Cxf" | < 3.4.10 Search vendor "Apache" for product "Cxf" and version " < 3.4.10" | - |
Affected
| ||||||
Apache Search vendor "Apache" | Cxf Search vendor "Apache" for product "Cxf" | >= 3.5.0 < 3.5.5 Search vendor "Apache" for product "Cxf" and version " >= 3.5.0 < 3.5.5" | - |
Affected
|