CVE-2022-46363: Apache CXF directory listing / code exfiltration
A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, and so the vulnerability can only arise if the CXF service is misconfigured.
Other sources
A vulnerability was found in Apache CXF that could allow an attacker to perform a remote directory listing or code exfiltration. This issue only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, so the issue can only occur if the CXF service is misconfigured.
Apache CXF could allow a remote attacker to obtain sensitive information, caused by a flaw when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. By sending a specially-crafted request, an attacker could exploit this vulnerability to perform directory listing or code exfiltration, and use this information to launch further attacks against the affected system.
— IBM
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this Apache CXF vulnerability?
The vulnerability ID for this Apache CXF vulnerability is CVE-2022-46363.
What is the severity of CVE-2022-46363?
CVE-2022-46363 has a severity level of 7.5 (high).
How does CVE-2022-46363 affect Apache CXF?
CVE-2022-46363 affects Apache CXF by allowing a remote attacker to obtain sensitive information through a flaw in the CXFServlet configuration.
Which versions of Apache CXF are affected by CVE-2022-46363?
Apache CXF versions 3.5.0 up to and including 3.5.5, as well as versions 3.4.10 and earlier, are affected by CVE-2022-46363.
How can I fix CVE-2022-46363 in Apache CXF?
To fix CVE-2022-46363 in Apache CXF, update to version 3.5.5 or apply the recommended patches provided by the vendor.