CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2022-46364
Critical (9.8) in apache cxf. EPSS 2.3% chance of exploitation in the next 30 days. Fixed in org.apache.cxf:cxf-core 3.4.10, 3.5.5.
A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.
Severity
- EPSS
- 2.3% chance of exploitation in the next 30 days; higher than 83% of CVEs (scores of 2026-10-31)
- CWE
- CWE-918
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:cxf
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-x3x3-qwjq-8gj4 | Maven | org.apache.cxf:cxf-core | <3.4.10 | 3.4.10 |
| GHSA-x3x3-qwjq-8gj4 | Maven | org.apache.cxf:cxf-core | >=3.5.0 <3.5.5 | 3.5.5 |