PT-2022-27839 · Apache · Apache Cxf

Thanat0S · Published 2022-12-13 · Updated 2025-04-22 · CVE-2022-46363

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 3.4.10 Apache CXF versions prior to 3.5.5

Description A vulnerability in Apache CXF allows an attacker to perform a remote directory listing or code exfiltration. This issue arises when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes, which are not intended to be used together. The vulnerability can only occur if the CXF service is misconfigured.

Recommendations For versions prior to 3.4.10, update to version 3.4.10 or later to resolve the issue. For versions prior to 3.5.5, update to version 3.5.5 or later to resolve the issue. As a temporary workaround, consider removing or correcting the misconfiguration of the CXFServlet by ensuring that the static-resources-list and redirect-query-check attributes are not used together.

Fix

RCE

Information Disclosure

Weakness Enumeration

CWE-20

CWE-200

Related Identifiers

CVE-2022-46363

GHSA-3W37-5P3P-JV92

RHSA-2023:1043

RHSA-2023:1044

RHSA-2023:1045

RHSA-2025:1746

RHSA-2025:1747

Affected Products

Apache Cxf

References · 7

• https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3w37-5p3p-jv92 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-46363 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-46363 · Security Note
• https://github.com/apache/cxf · Note
• https://t.me/cvenotify/119285 · Telegram Post
• https://t.me/cvenotify/40018 · Telegram Post