PT-2022-27480 · Apache · Apache Soap

Tsungshu Chiu · Published 2022-11-14 · Updated 2024-08-03 · CVE-2022-45378

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache SOAP (affected versions not specified)

Description The default configuration of Apache SOAP includes an RPCRouterServlet that is available without authentication, allowing an attacker to invoke methods on the classpath that meet certain criteria. Depending on the classes available on the classpath, this could lead to arbitrary remote code execution. This issue only affects products that are no longer supported by the maintainer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Improper Authentication

Deserialization of Untrusted Data

Weakness Enumeration

CWE-306

CWE-287

CWE-502

Related Identifiers

CVE-2022-45378

GHSA-789V-H9HW-38PG

Affected Products

Apache Soap

References · 11

• https://lists.apache.org/thread/g4l64s283njhnph2otx7q4gs2j952d31 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45378 · Security Note
• https://osv.dev/vulnerability/CVE-2022-45378 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-789v-h9hw-38pg · Vendor Advisory
• https://t.me/cvenotify/86695 · Telegram Post
• http://openwall.com/lists/oss-security/2022/11/14/4 · Note
• https://t.me/cvenotify/53104 · Telegram Post
• https://t.me/cvenotify/88776 · Telegram Post
• https://t.me/cvenotify/37616 · Telegram Post
• https://t.me/cvenotify/45246 · Telegram Post
• https://t.me/cvenotify/53139 · Telegram Post