CVE-2022-46364

🗓️ 13 Dec 2022 16:20:26Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 482 Views🌐 WEB

SSRF vulnerability in Apache CXF before 3.5.

Reporter	Title	Published	Views	Family All 141
IBM Security Bulletins	Security Bulletin: Vulnerability found in cxf-core-3.5.4.jar which is shipped with IBM® Intelligent Operations Center(CVE-2022-46364)	5 Sep 202313:26	–	ibm
IBM Security Bulletins	Security Bulletin: server-side request forgery vulnerability in Apache CXF (CVE-2022-46364) may affect CICS TX Advanced	10 Mar 202316:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities	7 Mar 202303:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is vulnerable to server-side request forgery due to Apache CXF (CVE-2022-46364)	20 Feb 202315:02	–	ibm
IBM Security Bulletins	Security Bulletin: WebSphere Application Server Liberty is vulnerable to server-side request forgery due to Apache CXF	16 Feb 202303:56	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in WebSphere Liberty shipped with IBM Security Guardium Key Lifecycle Manager (SKLM/GKLM) (CVE-2022-46364)	25 Oct 202407:07	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities were identified in IBM Security Verify Access (CVE-2023-46158, CVE-2023-0482, CVE-2022-46364, CVE-2023-28867)	17 Jan 202415:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance has multiple vulnerabilities (CVE-2022-41946, CVE-2022-46364, CVE-2023-24998)	18 Jul 202306:05	–	ibm
IBM Security Bulletins	Security Bulletin: InfoSphere Identity Insight vulnerable to server-side request forgery due to Apache CXF (CVE-2022-46364)	16 Mar 202319:06	–	ibm
IBM Security Bulletins	Security Bulletin: server-side request forgery vulnerability in Apache CXF (CVE-2022-46364) may affect CICS TX Standard	10 Mar 202316:02	–	ibm

NVD

Vulners

Node

apache cxfRange<3.4.10

apache cxfRange3.5.0–3.5.5

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache CXF",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "3.5.5",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      },
      {
        "lessThan": "3.4.10",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
cxf	www.cxf.apache.org/security-advisories.data/CVE-2022-46364.txt

Parameter	Position	Path	Description	CWE
href	request body	devarea.htb:8080/employeeservice	CVE-2022-46364: Apache CXF MTOM/XOP SSRF via href attribute dereference in MTOM/XOP processing.	CWE-918

17 Jun 2026 05:11Current

9.4High risk

Vulners AI Score9.4

CVSS 3.19.8

EPSS0.02371

SSVC

CWE-918