GHSA-x3x3-qwjq-8gj4

ghsaUSosv

Apache CXF Server-Side Request Forgery vulnerability

view advisory published 2022-12-13Licence: CC-BY-4.0

A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-46364US	critical9.8	2.31% (83rd)	Exploit	2022-12-13
A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attack…

references

External citations — patches, advisories, analysis.

https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1&modificationDate=1670944472739&api=v2WEB
https://nvd.nist.gov/vuln/detail/CVE-2022-46364ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan