Vulnerability · Published Dec 13, 2022 · Assigned by apache

CVE-2022-46363Apache CXF directory listing / code exfiltration

High 7.5

In plain English

A high-severity improper input validation in Apache CXF from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)1.3%top 30.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, and so the vulnerability can only arise if the CXF service is misconfigured.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.apache.cxf:cxf-core	3.4.10	GHSA-3w37-5p3p-jv92
Maven	org.apache.cxf:cxf-core	3.5.5	GHSA-3w37-5p3p-jv92

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache CXF	3.5 – before 3.5.53.4 – before 3.4.10

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c vendor-advisory