Skip to content
Fencer Vulns
critical 9.8

CVE-2022-46364 json

Apache CXF SSRF Vulnerability

published 2022-12-13 3 y ago modified 2026-06-17 4 mo ago also GHSA-x3x3-qwjq-8gj4 , EUVD-2022-7768

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.3%
EPSS 2.3% chance of exploitation in 30 days, percentile 83%
public exploits
0
none known

Summary

A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.

Patch / fix

  • maven org.apache.cxf:cxf-core 3.4.10, 3.5.5
  • Apache Software Foundation Apache CXF 3.4.10, 3.5.5
  • rh-sso7-keycloak red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el7sso
  • rh-sso7-keycloak-server red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el7sso
  • rh-sso7-keycloak red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el8sso
  • rh-sso7-keycloak-server red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el8sso
  • rh-sso7-keycloak red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el9sso
  • rh-sso7-keycloak-server red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el9sso
  • eap7-wildfly jboss enterprise application platform 7.4 7.4.9-4.GA_redhat_00003.1.el8eap
  • eap7-jettison jboss enterprise application platform 7.4 1.5.2-1.redhat_00002.1.el8eap

red hat advisories RHSA-2024:10208RHSA-2024:10207RHSA-2023:1043RHSA-2023:1044RHSA-2023:1045RHSA-2023:0553

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-46364 updated cvss 9.8

CXF: SSRF Vulnerability

  • Red Hat build of Quarkus cxf Red Hat Data Grid 8 cxf
    affected: no fix available
  • Red Hat JBoss Data Grid 7 cxf Red Hat JBoss Data Virtualization 6 cxf Red Hat JBoss Enterprise Application Platform 6 cxf, apache-cxf, jbossws-cxf, jboss-on jboss-on, org.osgi.core-eap6 org.osgi.core-eap6, jbossas-modules-eap jbossas-modules-eap, +7 more Red Hat JBoss Fuse 6 cxf Red Hat JBoss Fuse Service Works 6 cxf
    affected: no fix planned “Out of support scope”
  • Red Hat Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8 7.6-20
    fixed: vendor fix RHSA-2023:1047
  • Red Hat Migration Toolkit for Runtimes 1 on RHEL 8 mtr/mtr-web-container-rhel8 1.0-22
    fixed: vendor fix RHSA-2023:1286
  • Red Hat MTA 6.1 for RHEL 8 mta/mta-windup-addon-rhel8 6.1.0-11
    fixed: vendor fix RHSA-2023:2041
  • Red Hat Fuse 7.11.1.P1
    fixed: vendor fix RHSA-2023:0483
  • Red Hat Fuse 7.12
    fixed: vendor fix RHSA-2023:3954
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-apache-cxf 3.4.10-1.redhat_00001.1.el7eap, eap7-apache-cxf-rt 3.4.10-1.redhat_00001.1.el7eap, eap7-apache-cxf-tools 3.4.10-1.redhat_00001.1.el7eap, eap7-apache-cxf-services 3.4.10-1.redhat_00001.1.el7eap Red Hat JBoss EAP 7.4 for RHEL 8 eap7-apache-cxf 3.4.10-1.redhat_00001.1.el8eap, eap7-apache-cxf-rt 3.4.10-1.redhat_00001.1.el8eap, eap7-apache-cxf-tools 3.4.10-1.redhat_00001.1.el8eap, eap7-apache-cxf-services 3.4.10-1.redhat_00001.1.el8eap Red Hat JBoss EAP 7.4 for RHEL 9 eap7-apache-cxf 3.4.10-1.redhat_00001.1.el9eap, eap7-apache-cxf-rt 3.4.10-1.redhat_00001.1.el9eap, eap7-apache-cxf-tools 3.4.10-1.redhat_00001.1.el9eap, eap7-apache-cxf-services 3.4.10-1.redhat_00001.1.el9eap
    fixed: vendor fix RHSA-2023:0163
show 11 more
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-apache-cxf 3.1.16-3.SP1_redhat_00001.1.ep7.el7, eap7-apache-cxf-rt 3.1.16-3.SP1_redhat_00001.1.ep7.el7, eap7-apache-cxf-tools 3.1.16-3.SP1_redhat_00001.1.ep7.el7, eap7-apache-cxf-services 3.1.16-3.SP1_redhat_00001.1.ep7.el7
    fixed: vendor fix RHSA-2024:10208
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-avro 1.7.6-8.redhat_00003.1.el7eap, eap7-wss4j 2.3.3-2.redhat_00001.1.el7eap, eap7-xalan-j2 2.7.1-38.redhat_00015.1.el7eap, eap7-wildfly 7.3.11-4.GA_redhat_00002.1.el7eap, eap7-h2database 1.4.197-3.redhat_00004.1.el7eap, eap7-wss4j-policy 2.3.3-2.redhat_00001.1.el7eap, +41 more
    fixed: vendor fix RHSA-2024:10207
  • Red Hat JBoss Enterprise Application Platform 7.4.9 cxf-core 3.4.10.redhat-00001
    fixed: vendor fix RHSA-2023:0164
  • Red Hat Single Sign-On 7
    fixed: vendor fix RHSA-2023:1049
  • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el7sso
    fixed: vendor fix RHSA-2023:1043
  • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el8sso
    fixed: vendor fix RHSA-2023:1044
  • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el9sso
    fixed: vendor fix RHSA-2023:1045
  • Red Hat RHINT Camel-Springboot 3.14.5.P1
    fixed: vendor fix RHSA-2023:0544
  • Red Hat RHINT Camel-Springboot 3.18.3.P2
    fixed: vendor fix RHSA-2023:3641
  • Red Hat RHPAM 7.13.1 async
    fixed: vendor fix RHSA-2023:2135
  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/elasticsearch6-rhel8 Red Hat Migration Toolkit for Runtimes 1 on RHEL 8 mtr/mtr-rhel8-operator 1.0-13, mtr/mtr-operator-bundle 1.0-37, mtr/mtr-web-executor-container-rhel8 1.0-21 Red Hat MTA 6.1 for RHEL 8 mta/mta-ui-rhel8 6.1.0-13, mta/mta-hub-rhel8 6.1.0-10, mta/mta-rhel8-operator 6.1.0-11, mta/mta-operator-bundle 6.1.0-16, mta/mta-pathfinder-rhel8 6.1.0-7 Red Hat Integration Camel K 1 cxf Red Hat Integration Camel Quarkus 1 cxf Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-wss4j 2.3.3-1.redhat_00001.1.el7eap, eap7-wss4j-policy 2.3.3-1.redhat_00001.1.el7eap, eap7-xml-security 2.2.3-1.redhat_00001.1.el7eap, eap7-wss4j-bindings 2.3.3-1.redhat_00001.1.el7eap, eap7-wss4j-ws-security-dom 2.3.3-1.redhat_00001.1.el7eap, eap7-wss4j-ws-security-stax 2.3.3-1.redhat_00001.1.el7eap, +2 more
    +5 more products
    Red Hat JBoss EAP 7.4 for RHEL 8 eap7-wss4j 2.3.3-1.redhat_00001.1.el8eap, eap7-wss4j-policy 2.3.3-1.redhat_00001.1.el8eap, eap7-xml-security 2.2.3-1.redhat_00001.1.el8eap, eap7-wss4j-bindings 2.3.3-1.redhat_00001.1.el8eap, eap7-wss4j-ws-security-dom 2.3.3-1.redhat_00001.1.el8eap, eap7-wss4j-ws-security-stax 2.3.3-1.redhat_00001.1.el8eap, +2 more Red Hat JBoss EAP 7.4 for RHEL 9 eap7-wss4j 2.3.3-1.redhat_00001.1.el9eap, eap7-wss4j-policy 2.3.3-1.redhat_00001.1.el9eap, eap7-xml-security 2.2.3-1.redhat_00001.1.el9eap, eap7-wss4j-bindings 2.3.3-1.redhat_00001.1.el9eap, eap7-wss4j-ws-security-dom 2.3.3-1.redhat_00001.1.el9eap, eap7-wss4j-ws-security-stax 2.3.3-1.redhat_00001.1.el9eap, +2 more Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-avro 1.7.6-2.redhat_00003.1.ep7.el7, eap7-xalan-j2 2.7.1-26.redhat_00015.1.ep7.el7, eap7-wildfly 7.1.8-2.GA_redhat_00002.1.ep7.el7, eap7-h2database 1.4.197-2.redhat_00005.1.ep7.el7, eap7-bouncycastle 1.68.0-1.redhat_00005.1.ep7.el7, eap7-bouncycastle-mail 1.68.0-1.redhat_00005.1.ep7.el7, +7 more Red Hat JBoss Enterprise Application Platform 7.4.9 pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, fs 2.1.2, ip 2.0.0, +1536 more Red Hat JBoss Enterprise Application Platform Expansion Pack cxf-core
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
18 mo ago

Exploit prediction

2.31% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.apache.cxf:cxf-core
<3.4.10
>=3.5.0, <3.5.5
3.4.10
3.5.5

Affected products

  • Apache Software Foundation Apache CXF

Classification

Weakness
  • CWE-918 Server-Side Request Forgery

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.