CVE-2022-46364

A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. 

Score

CVSS 3.1 9.8 Critical

Status

Modified - security@apache.org

Published

2022-12-13

Last modified

2025-04-22

Weaknesses

CWE-918

Affected products

• Cxf (Apache)
• Apache Cxf (Apache Software Foundation)

References

• https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1&modificationDate=1670944472739&api=v2