{"id":"CVE-2022-46364","state":"PUBLISHED","title":"Apache CXF SSRF Vulnerability","description":"A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. ","publishedAt":"2022-12-13T16:20:26.765Z","updatedAt":"2025-04-22T02:48:36.211Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"apache","products":["Apache Software Foundation Apache CXF"],"affected":[{"vendor":"Apache Software Foundation","product":"Apache CXF","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.5.5","versionType":"custom"},{"version":"0","status":"affected","lessThan":"3.4.10","versionType":"custom"}]}],"references":["https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1&modificationDate=1670944472739&api=v2"],"weaknesses":["CWE-918"],"ingestedAt":"2026-10-29T19:50:53.608Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/46xxx/CVE-2022-46364.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-46364","state":"PUBLISHED","datePublished":"2022-12-13T16:20:26.765Z","dateUpdated":"2025-04-22T02:48:36.211Z","assignerShortName":"apache","assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","requesterUserId":"cf81350d-439c-4450-9d42-0a054bb6b6c9","dateReserved":"2022-12-02T08:07:46.894Z"},"containers":{"cna":{"title":"Apache CXF SSRF Vulnerability","descriptions":[{"lang":"en","value":"A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. "}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache CXF","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.5.5","versionType":"custom"},{"version":"0","status":"affected","lessThan":"3.4.10","versionType":"custom"}]}],"references":[{"url":"https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1&modificationDate=1670944472739&api=v2","tags":["vendor-advisory"]}],"metrics":[{"other":{"content":{"text":"important"},"type":"Textual description of severity"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-918","description":"CWE-918 Server-Side Request Forgery (SSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"apache","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateUpdated":"2022-12-13T16:20:26.765Z"},"credits":[{"lang":"en","type":"finder","value":"thanat0s from Beijin Qihoo 360 adlab"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1&modificationDate=1670944472739&api=v2","tags":["vendor-advisory","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T14:31:46.249Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-04-22T02:48:12.377210Z","id":"CVE-2022-46364","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-04-22T02:48:36.211Z"}}]}}}