CVE-2022-40705

CVE-2022-40705 describes an XML External Entity (XXE) vulnerability in Apache SOAP’s RPCRouterServlet. A crafted XML payload can allow an unauthenticated attacker to read arbitrary files over HTTP. The CVSS v3.1 base score is 7.5 (HIGH); attack vector NETWORK, no user interaction required. Affect...

CVE-2022-45378

Oracle WebCenter Portal versions affected include 12.2.1.4.0, where the Portal Core component (Apache SOAP) is vulnerable due to a default unauthenticated RPCRouterServlet. This could allow an attacker to invoke methods on classpath entries and, depending on available classes, may lead to arbitra...