CVE-2022-46363: Apache CXF directory listing / code exfiltration
A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, and so the vulnerability can only arise if the CXF service is misconfigured.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this Apache CXF vulnerability?
The vulnerability ID for this Apache CXF vulnerability is CVE-2022-46363.
What is the severity of CVE-2022-46363?
CVE-2022-46363 has a severity level of 7.5 (high).
How does CVE-2022-46363 affect Apache CXF?
CVE-2022-46363 affects Apache CXF by allowing a remote attacker to obtain sensitive information through a flaw in the CXFServlet configuration.
Which versions of Apache CXF are affected by CVE-2022-46363?
Apache CXF versions 3.5.0 up to and including 3.5.5, as well as versions 3.4.10 and earlier, are affected by CVE-2022-46363.
How can I fix CVE-2022-46363 in Apache CXF?
To fix CVE-2022-46363 in Apache CXF, update to version 3.5.5 or apply the recommended patches provided by the vendor.