CVE-2022-46363
Apache CXF directory listing / code exfiltration
7.5 HighFix available
A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, and so the vulnerability can only arise if the CXF service is misconfigured.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
1.26%Up 0.4 points since Dec 14, 2022
What each source reports
NVD Score used
A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, and so the vulnerability can only arise if the CXF service is misconfigured.
- Record
CVE-2022-46363- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List
Apache CXF directory listing / code exfiltration
A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, and so the vulnerability can only arise if the CXF service is misconfigured.
- Record
CVE-2022-46363- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2022-7492
A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, and so the vulnerability can only arise if the CXF service is misconfigured.
- Record
EUVD-2022-7492- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3w37-5p3p-jv92
Apache CXF vulnerable to Exposure of Sensitive Information
A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, and so the vulnerability can only arise if the CXF service is misconfigured.
- Record
GHSA-3w37-5p3p-jv92- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-20, CWE-200
- Updated
- 2026-11-02
OSV
Apache CXF directory listing / code exfiltration
A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, and so the vulnerability can only arise if the CXF service is misconfigured.
- Record
CVE-2022-46363- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-3w37-5p3p-jv92
Apache CXF vulnerable to Exposure of Sensitive Information
A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, and so the vulnerability can only arise if the CXF service is misconfigured.
- Record
GHSA-3w37-5p3p-jv92- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-20, CWE-200
- Updated
- 2026-11-02
Show 6 moreShow less
OSVRHSA-2023:1043
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 7
- Record
RHSA-2023:1043- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:1044
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 8
- Record
RHSA-2023:1044- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:1045
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 9
- Record
RHSA-2023:1045- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2025:1746
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.9 on RHEL 7 security update
- Record
RHSA-2025:1746- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2025:1747
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.12 security update
- Record
RHSA-2025:1747- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1776040410 No score
TuxCare security update for org.apache.cxf (6 CVEs)
TuxCare rebuilt 5 org.apache.cxf packages to address 6 CVEs. Fixed in 3.4.5-tuxcare.1.
- Record
CLSA-2026-1776040410- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.cxf:cxf-coreMaven |
before 3.4.10 | 3.4.10 |
org.apache.cxf:cxf-coreMaven |
3.5.0 up to 3.5.5 | 3.5.5 |
org.apache.cxf:cxf-coreTuxCare:Maven From an advisory covering 6 CVEs |
3.4.5 up to 3.4.5-tuxcare.1 | 3.4.5-tuxcare.1 |
org.apache.cxf:cxf-rt-databinding-aegisTuxCare:Maven From an advisory covering 6 CVEs |
3.4.5 up to 3.4.5-tuxcare.1 | 3.4.5-tuxcare.1 |
org.apache.cxf:cxf-rt-rs-security-joseTuxCare:Maven From an advisory covering 6 CVEs |
3.4.5 up to 3.4.5-tuxcare.1 | 3.4.5-tuxcare.1 |
org.apache.cxf:cxf-rt-rs-service-descriptionTuxCare:Maven From an advisory covering 6 CVEs |
3.4.5 up to 3.4.5-tuxcare.1 | 3.4.5-tuxcare.1 |
org.apache.cxf:cxf-rt-transports-jmsTuxCare:Maven From an advisory covering 6 CVEs |
3.4.5 up to 3.4.5-tuxcare.1 | 3.4.5-tuxcare.1 |
org.apache.cxf:cxf-coreMaven |
before 3.4.10, plus listed versions 3.0.03.0.0-milestone13.0.0-milestone23.0.13.0.10 Show 45 moreShow less3.0.113.0.123.0.133.0.143.0.153.0.163.0.23.0.33.0.43.0.53.0.63.0.73.0.83.0.93.1.03.1.13.1.103.1.113.1.123.1.133.1.143.1.153.1.163.1.173.1.183.1.23.1.33.1.43.1.53.1.63.1.73.1.83.1.93.2.03.2.13.2.103.2.113.2.123.2.133.2.143.2.23.2.33.2.43.2.53.2.6 |
3.4.10 |
org.apache.cxf:cxf-coreMaven |
3.5.0 up to 3.5.5, plus listed versions 3.5.13.5.23.5.33.5.4 |
3.5.5 |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7.6::el7 From an advisory covering 31 CVEs |
before 0:18.0.6-1.redhat_00001.1.el7sso | 0:18.0.6-1.redhat_00001.1.el7sso |
Show 75 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7.6::el7 From an advisory covering 31 CVEs |
before 0:18.0.6-1.redhat_00001.1.el7sso | 0:18.0.6-1.redhat_00001.1.el7sso |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7.6::el8 From an advisory covering 31 CVEs |
before 0:18.0.6-1.redhat_00001.1.el8sso | 0:18.0.6-1.redhat_00001.1.el8sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7.6::el8 From an advisory covering 31 CVEs |
before 0:18.0.6-1.redhat_00001.1.el8sso | 0:18.0.6-1.redhat_00001.1.el8sso |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7.6::el9 From an advisory covering 31 CVEs |
before 0:18.0.6-1.redhat_00001.1.el9sso | 0:18.0.6-1.redhat_00001.1.el9sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7.6::el9 From an advisory covering 31 CVEs |
before 0:18.0.6-1.redhat_00001.1.el9sso | 0:18.0.6-1.redhat_00001.1.el9sso |
eap7-jackson-databindRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 18 CVEs |
before 0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7 | 0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7 |
eap7-resteasyRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 18 CVEs |
before 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 | 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 |
eap7-resteasy-atom-providerRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 18 CVEs |
before 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 | 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 |
eap7-resteasy-cdiRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 18 CVEs |
before 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 | 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 |
eap7-resteasy-clientRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 18 CVEs |
before 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 | 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 |
eap7-resteasy-cryptoRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 18 CVEs |
before 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 | 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 |
eap7-resteasy-jackson-providerRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 18 CVEs |
before 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 | 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 |
eap7-resteasy-jackson2-providerRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 18 CVEs |
before 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 | 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 |
eap7-resteasy-jaxb-providerRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 18 CVEs |
before 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 | 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 |
eap7-resteasy-jaxrsRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 18 CVEs |
before 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 | 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 |
eap7-resteasy-jettison-providerRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 18 CVEs |
before 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 | 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 |
eap7-resteasy-jose-jwtRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 18 CVEs |
before 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 | 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 |
eap7-resteasy-jsapiRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 18 CVEs |
before 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 | 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 |
eap7-resteasy-json-p-providerRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 18 CVEs |
before 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 | 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 |
eap7-resteasy-multipart-providerRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 18 CVEs |
before 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 | 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 |
eap7-resteasy-springRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 18 CVEs |
before 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 | 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 |
eap7-resteasy-validator-provider-11Red Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 18 CVEs |
before 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 | 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 |
eap7-resteasy-yaml-providerRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 18 CVEs |
before 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 | 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 |
eap7-velocityRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 18 CVEs |
before 0:1.7.0-3.redhat_00006.1.ep7.el7 | 0:1.7.0-3.redhat_00006.1.ep7.el7 |
eap7-wildflyRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 18 CVEs |
before 0:7.1.9-2.GA_redhat_00002.1.ep7.el7 | 0:7.1.9-2.GA_redhat_00002.1.ep7.el7 |
eap7-wildfly-modulesRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 18 CVEs |
before 0:7.1.9-2.GA_redhat_00002.1.ep7.el7 | 0:7.1.9-2.GA_redhat_00002.1.ep7.el7 |
eap7-apache-cxfRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 18 CVEs |
before 0:3.1.16-4.redhat_00003.1.ep7.el7 | 0:3.1.16-4.redhat_00003.1.ep7.el7 |
eap7-apache-cxf-rtRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 18 CVEs |
before 0:3.1.16-4.redhat_00003.1.ep7.el7 | 0:3.1.16-4.redhat_00003.1.ep7.el7 |
eap7-apache-cxf-servicesRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 18 CVEs |
before 0:3.1.16-4.redhat_00003.1.ep7.el7 | 0:3.1.16-4.redhat_00003.1.ep7.el7 |
eap7-apache-cxf-toolsRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 18 CVEs |
before 0:3.1.16-4.redhat_00003.1.ep7.el7 | 0:3.1.16-4.redhat_00003.1.ep7.el7 |
eap7-jettisonRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 18 CVEs |
before 0:1.3.8-2.redhat_00002.1.ep7.el7 | 0:1.3.8-2.redhat_00002.1.ep7.el7 |
eap7-nettyRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 18 CVEs |
before 0:4.1.63-1.Final_redhat_00002.1.ep7.el7 | 0:4.1.63-1.Final_redhat_00002.1.ep7.el7 |
eap7-netty-allRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 18 CVEs |
before 0:4.1.63-1.Final_redhat_00002.1.ep7.el7 | 0:4.1.63-1.Final_redhat_00002.1.ep7.el7 |
eap7-snakeyamlRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 18 CVEs |
before 0:1.33.0-1.SP1_redhat_00001.1.ep7.el7 | 0:1.33.0-1.SP1_redhat_00001.1.ep7.el7 |
eap7-hal-consoleRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:3.2.17-1.Final_redhat_00001.1.el7eap | 0:3.2.17-1.Final_redhat_00001.1.el7eap |
eap7-jackson-annotationsRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:2.10.4-2.redhat_00004.1.el7eap | 0:2.10.4-2.redhat_00004.1.el7eap |
eap7-jackson-coreRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:2.10.4-2.redhat_00004.1.el7eap | 0:2.10.4-2.redhat_00004.1.el7eap |
eap7-jackson-databindRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:2.10.4-4.redhat_00004.1.el7eap | 0:2.10.4-4.redhat_00004.1.el7eap |
eap7-jackson-datatype-jdk8Red Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:2.10.4-2.redhat_00004.1.el7eap | 0:2.10.4-2.redhat_00004.1.el7eap |
eap7-jackson-datatype-jsr310Red Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:2.10.4-2.redhat_00004.1.el7eap | 0:2.10.4-2.redhat_00004.1.el7eap |
eap7-jackson-jaxrs-baseRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:2.10.4-2.redhat_00004.1.el7eap | 0:2.10.4-2.redhat_00004.1.el7eap |
eap7-jackson-jaxrs-json-providerRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:2.10.4-2.redhat_00004.1.el7eap | 0:2.10.4-2.redhat_00004.1.el7eap |
eap7-jackson-jaxrs-providersRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:2.10.4-2.redhat_00004.1.el7eap | 0:2.10.4-2.redhat_00004.1.el7eap |
eap7-jackson-module-jaxb-annotationsRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:2.10.4-4.redhat_00004.1.el7eap | 0:2.10.4-4.redhat_00004.1.el7eap |
eap7-jackson-modules-baseRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:2.10.4-4.redhat_00004.1.el7eap | 0:2.10.4-4.redhat_00004.1.el7eap |
eap7-jackson-modules-java8Red Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:2.10.4-2.redhat_00004.1.el7eap | 0:2.10.4-2.redhat_00004.1.el7eap |
eap7-jettisonRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:1.5.2-2.redhat_00002.1.el7eap | 0:1.5.2-2.redhat_00002.1.el7eap |
eap7-nettyRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:4.1.63-4.Final_redhat_00002.1.el7eap | 0:4.1.63-4.Final_redhat_00002.1.el7eap |
eap7-netty-allRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:4.1.63-4.Final_redhat_00002.1.el7eap | 0:4.1.63-4.Final_redhat_00002.1.el7eap |
eap7-resteasyRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:3.11.6-1.Final_redhat_00001.1.el7eap | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-atom-providerRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:3.11.6-1.Final_redhat_00001.1.el7eap | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-cdiRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:3.11.6-1.Final_redhat_00001.1.el7eap | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-clientRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:3.11.6-1.Final_redhat_00001.1.el7eap | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-client-microprofileRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:3.11.6-1.Final_redhat_00001.1.el7eap | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-cryptoRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:3.11.6-1.Final_redhat_00001.1.el7eap | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-jackson-providerRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:3.11.6-1.Final_redhat_00001.1.el7eap | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-jackson2-providerRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:3.11.6-1.Final_redhat_00001.1.el7eap | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-jaxb-providerRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:3.11.6-1.Final_redhat_00001.1.el7eap | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-jaxrsRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:3.11.6-1.Final_redhat_00001.1.el7eap | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-jettison-providerRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:3.11.6-1.Final_redhat_00001.1.el7eap | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-jose-jwtRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:3.11.6-1.Final_redhat_00001.1.el7eap | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-jsapiRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:3.11.6-1.Final_redhat_00001.1.el7eap | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-json-binding-providerRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:3.11.6-1.Final_redhat_00001.1.el7eap | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-json-p-providerRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:3.11.6-1.Final_redhat_00001.1.el7eap | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-multipart-providerRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:3.11.6-1.Final_redhat_00001.1.el7eap | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-rxjava2Red Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:3.11.6-1.Final_redhat_00001.1.el7eap | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-springRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:3.11.6-1.Final_redhat_00001.1.el7eap | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-validator-provider-11Red Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:3.11.6-1.Final_redhat_00001.1.el7eap | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
eap7-resteasy-yaml-providerRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:3.11.6-1.Final_redhat_00001.1.el7eap | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
eap7-snakeyamlRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:1.33.0-1.SP1_redhat_00001.1.el7eap | 0:1.33.0-1.SP1_redhat_00001.1.el7eap |
eap7-wildflyRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:7.3.12-3.GA_redhat_00002.1.el7eap | 0:7.3.12-3.GA_redhat_00002.1.el7eap |
eap7-wildfly-java-jdk11Red Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:7.3.12-3.GA_redhat_00002.1.el7eap | 0:7.3.12-3.GA_redhat_00002.1.el7eap |
eap7-wildfly-java-jdk8Red Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:7.3.12-3.GA_redhat_00002.1.el7eap | 0:7.3.12-3.GA_redhat_00002.1.el7eap |
eap7-wildfly-javadocsRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:7.3.12-3.GA_redhat_00002.1.el7eap | 0:7.3.12-3.GA_redhat_00002.1.el7eap |
eap7-wildfly-modulesRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 13 CVEs |
before 0:7.3.12-3.GA_redhat_00002.1.el7eap | 0:7.3.12-3.GA_redhat_00002.1.el7eap |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-46363 is a high vulnerability (CVSS 7.5) in Apache Cxf, published December 13, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.26%, the 69th percentile. Fixed in org.apache.cxf:cxf-core 3.4.10.
References
lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c
nvd.nist.gov/vuln/detail/CVE-2022-46363
github.com/advisories/GHSA-3w37-5p3p-jv92
access.redhat.com/errata/RHSA-2023:1043
Show 194 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=1601614
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1043.json
cve.org/CVERecord?id=CVE-2018-14040
blog.jquery.com/2019/04/10/jquery-3-4-0-released
drupal.org/sa-core-2019-006
cisa.gov/known-exploited-vulnerabilities-catalog
security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294
bitbucket.org/snakeyaml/snakeyaml/issues/525
mail-archive.com/[email protected]/msg39312.html
cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1&modificationDate=1670944472739&api=v2
docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1
issues.redhat.com/browse/JBEAP-28583
logging.apache.org/log4j/2.x/security.html
lunasec.io/docs/blog/log4j-zero-day
openwall.com/lists/oss-security/2021/12/14/4
blogs.apache.org/security/entry/cve-2022-42889
seclists.org/oss-sec/2022/q4/22
This page doesn't list everything
Left out here: 27 versions and 25 references. The JSON record has them.