CVE-2022-46363 Apache CXF directory listing / code exfiltration

2022-12-1314:46:55

CWE-20

apache

www.cve.org

7.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

36.8%

JSON

A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, and so the vulnerability can only arise if the CXF service is misconfigured.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache CXF",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "3.5.5",
        "status": "affected",
        "version": "3.5",
        "versionType": "maven"
      },
      {
        "lessThan": "3.4.10",
        "status": "affected",
        "version": "3.4",
        "versionType": "maven"
      }
    ]
  }
]