CVE-2022-46363: Apache CXF directory listing / code exfiltration
First published: Tue Dec 13 2022(Updated: )
A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, and so the vulnerability can only arise if the CXF service is misconfigured.
Credit: security@apache.org security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.apache.cxf:cxf-core | >=3.5.0<3.5.5 | 3.5.5 |
| maven/org.apache.cxf:cxf-core | <3.4.10 | 3.4.10 |
| redhat/rh-sso7-keycloak | <0:18.0.6-1.redhat_00001.1.el7 | 0:18.0.6-1.redhat_00001.1.el7 |
| redhat/rh-sso7-keycloak | <0:18.0.6-1.redhat_00001.1.el8 | 0:18.0.6-1.redhat_00001.1.el8 |
| redhat/rh-sso7-keycloak | <0:18.0.6-1.redhat_00001.1.el9 | 0:18.0.6-1.redhat_00001.1.el9 |
| IBM Security Verify Governance | <=10.0 | |
| Apache CXF | <3.4.10 | |
| Apache CXF | >=3.5.0<3.5.5 | |
| redhat/Apache CXF | <3.5.5 | 3.5.5 |
| redhat/Apache CXF | <3.4.10 | 3.4.10 |
| <3.4.10 | ||
| >=3.5.0<3.5.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2022-46363
- https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c
- https://github.com/advisories/GHSA-3w37-5p3p-jv92 (Advisory)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/242009
- https://www.ibm.com/support/pages/node/7047640 (Advisory)
- https://access.redhat.com/errata/RHSA-2023:0483
- https://access.redhat.com/errata/RHSA-2023:0544
- https://access.redhat.com/security/cve/cve-2022-46363
- https://access.redhat.com/errata/RHSA-2023:1043
- https://access.redhat.com/errata/RHSA-2023:1044
- https://access.redhat.com/errata/RHSA-2023:1045
- https://access.redhat.com/errata/RHSA-2023:1047
- https://access.redhat.com/errata/RHSA-2023:1049
- https://access.redhat.com/errata/RHSA-2023:3641
- https://access.redhat.com/errata/RHSA-2023:3906
- https://access.redhat.com/errata/RHSA-2023:3954
- https://bugzilla.redhat.com/show_bug.cgi?id=2155681
- https://www.cve.org/CVERecord?id=CVE-2022-46363 https://nvd.nist.gov/vuln/detail/CVE-2022-46363 https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is the vulnerability ID for this Apache CXF vulnerability?
The vulnerability ID for this Apache CXF vulnerability is CVE-2022-46363.
What is the severity of CVE-2022-46363?
CVE-2022-46363 has a severity level of 7.5 (high).
How does CVE-2022-46363 affect Apache CXF?
CVE-2022-46363 affects Apache CXF by allowing a remote attacker to obtain sensitive information through a flaw in the CXFServlet configuration.
Which versions of Apache CXF are affected by CVE-2022-46363?
Apache CXF versions 3.5.0 up to and including 3.5.5, as well as versions 3.4.10 and earlier, are affected by CVE-2022-46363.
How can I fix CVE-2022-46363 in Apache CXF?
To fix CVE-2022-46363 in Apache CXF, update to version 3.5.5 or apply the recommended patches provided by the vendor.
- collector/github-advisory-latest
- alias/GHSA-3w37-5p3p-jv92
- alias/CVE-2022-46363
- collector/github-advisory
- collector/redhat-cve
- collector/ibm-support
- collector/nvd-index
- collector/nvd-cve
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/references
- agent/severity
- collector/redhat-bugzilla
- source/Red Hat
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/description
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/author
- agent/tags
- agent/softwarecombine
- agent/event
- agent/trending
- package-manager/maven
- package-manager/redhat
- vendor/ibm
- canonical/ibm security verify governance
- version/ibm security verify governance/10.0
- vendor/apache
- canonical/apache cxf
- version/apache cxf/3.5.0