CVE-2022-46364 Apache CXF SSRF Vulnerability

2022-12-1316:20:26

CWE-918

apache

www.cve.org

apache cxf

ssrf

mtom requests

9.5 High

AI Score

Confidence

High

0.042 Low

EPSS

Percentile

92.3%

JSON

A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache CXF",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "3.5.5",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      },
      {
        "lessThan": "3.4.10",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]