PT-2022-25482 · Apache · Apache Soap

Tsungshu Chiu · Published 2022-09-22 · Updated 2025-09-28 · CVE-2022-40705

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache SOAP versions 2.2 and later

Description An Improper Restriction of XML External Entity Reference vulnerability in RPCRouterServlet of Apache SOAP allows an attacker to read arbitrary files over HTTP. This issue only affects products that are no longer supported by the maintainer.

Recommendations For Apache SOAP versions 2.2 and later, consider disabling the RPCRouterServlet until a patch is available, as these versions are no longer supported by the maintainer. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2022-40705

GHSA-JQ8C-J47C-VVWM

Affected Products

Apache Soap

References · 8

• https://osv.dev/vulnerability/CVE-2022-40705 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-40705 · Security Note
• https://lists.apache.org/thread/02yo04w93rdjmllz4454lvodn5xzhwhl · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jq8c-j47c-vvwm · Vendor Advisory
• https://t.me/cvenotify/86419 · Telegram Post
• https://t.me/cvenotify/36651 · Telegram Post
• http://openwall.com/lists/oss-security/2022/09/22/1 · Note
• https://t.me/cvenotify/88770 · Telegram Post