A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.
References
| Link | Resource |
|---|---|
| https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1&modificationDate=1670944472739&api=v2 | Vendor Advisory |
Configurations
History
07 Nov 2023, 03:55
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. |
15 Dec 2022, 21:02
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| References | (MISC) https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1&modificationDate=1670944472739&api=v2 - Vendor Advisory | |
| First Time |
Apache
Apache cxf |
|
| CPE | cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:* |
13 Dec 2022, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-12-13 17:15
Updated : 2023-12-10 14:48
NVD link : CVE-2022-46364
Mitre link : CVE-2022-46364
CVE.ORG link : CVE-2022-46364
JSON object : View
Products Affected
apache
- cxf
CWE
CWE-918
Server-Side Request Forgery (SSRF)