{"id":"CVE-2022-46363","aliases":["CLSA-2026-1776040410","EUVD-2022-7492","GHSA-3w37-5p3p-jv92","RHSA-2023:1043","RHSA-2023:1044","RHSA-2023:1045","RHSA-2025:1746","RHSA-2025:1747"],"status":"published","title":"Apache CXF directory listing / code exfiltration","description":"A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, and so the vulnerability can only arise if the CXF service is misconfigured.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01261,"percentile":0.70011,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-200"],"published":"2022-12-13T14:46:55Z","modified":"2026-11-02T19:45:23Z","fixes":[{"ecosystem":"Maven","package":"org.apache.cxf:cxf-core","fixed_in":["3.4.10","3.5.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.cxf:cxf-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.10"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.cxf:cxf-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0"},{"fixed":"3.5.5"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"3.4.5-tuxcare.1"}]}],"versions":["3.4.5"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-databinding-aegis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"3.4.5-tuxcare.1"}]}],"versions":["3.4.5"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-rs-security-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"3.4.5-tuxcare.1"}]}],"versions":["3.4.5"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-rs-service-description","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"3.4.5-tuxcare.1"}]}],"versions":["3.4.5"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-transports-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"3.4.5-tuxcare.1"}]}],"versions":["3.4.5"],"bundled":6},{"source":"osv","ecosystem":"Maven","package":"org.apache.cxf:cxf-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.10"}]}],"versions":["3.0.0","3.0.0-milestone1","3.0.0-milestone2","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.14","3.0.15","3.0.16","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.15","3.1.16","3.1.17","3.1.18","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0","3.2.1","3.2.10","3.2.11","3.2.12","3.2.13","3.2.14","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8","3.2.9","3.3.0","3.3.1","3.3.10","3.3.11","3.3.12","3.3.13","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6","3.3.7","3.3.8","3.3.9","3.4.0","3.4.1","3.4.2","3.4.3","3.4.4","3.4.5","3.4.6","3.4.7","3.4.8","3.4.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.cxf:cxf-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0"},{"fixed":"3.5.5"}]}],"versions":["3.5.0","3.5.1","3.5.2","3.5.3","3.5.4"]},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el7","package":"rh-sso7-keycloak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0.6-1.redhat_00001.1.el7sso"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el7","package":"rh-sso7-keycloak-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0.6-1.redhat_00001.1.el7sso"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el8","package":"rh-sso7-keycloak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0.6-1.redhat_00001.1.el8sso"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el8","package":"rh-sso7-keycloak-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0.6-1.redhat_00001.1.el8sso"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el9","package":"rh-sso7-keycloak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0.6-1.redhat_00001.1.el9sso"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el9","package":"rh-sso7-keycloak-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0.6-1.redhat_00001.1.el9sso"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.27-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-resteasy-atom-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.27-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-resteasy-cdi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.27-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-resteasy-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.27-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-resteasy-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.27-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-resteasy-jackson-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.27-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-resteasy-jackson2-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.27-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-resteasy-jaxb-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.27-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-resteasy-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.27-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-resteasy-jettison-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.27-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-resteasy-jose-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.27-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-resteasy-jsapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.27-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-resteasy-json-p-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.27-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-resteasy-multipart-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.27-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-resteasy-spring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.27-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-resteasy-validator-provider-11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.27-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-resteasy-yaml-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.27-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-velocity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.0-3.redhat_00006.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.1.9-2.GA_redhat_00002.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-wildfly-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.1.9-2.GA_redhat_00002.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-apache-cxf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.16-4.redhat_00003.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-apache-cxf-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.16-4.redhat_00003.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-apache-cxf-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.16-4.redhat_00003.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-apache-cxf-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.16-4.redhat_00003.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-jettison","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.8-2.redhat_00002.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.63-1.Final_redhat_00002.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-netty-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.63-1.Final_redhat_00002.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-1.SP1_redhat_00001.1.ep7.el7"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-hal-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.17-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.4-2.redhat_00004.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.4-2.redhat_00004.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.4-4.redhat_00004.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jackson-datatype-jdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.4-2.redhat_00004.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jackson-datatype-jsr310","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.4-2.redhat_00004.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jackson-jaxrs-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.4-2.redhat_00004.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jackson-jaxrs-json-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.4-2.redhat_00004.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jackson-jaxrs-providers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.4-2.redhat_00004.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jackson-module-jaxb-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.4-4.redhat_00004.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jackson-modules-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.4-4.redhat_00004.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jackson-modules-java8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.4-2.redhat_00004.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jettison","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.2-2.redhat_00002.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.63-4.Final_redhat_00002.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-netty-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.63-4.Final_redhat_00002.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-atom-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-cdi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-client-microprofile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-jackson-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-jackson2-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-jaxb-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-jettison-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-jose-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-jsapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-json-binding-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-json-p-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-multipart-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-rxjava2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-spring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-validator-provider-11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-resteasy-yaml-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.6-1.Final_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-1.SP1_redhat_00001.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.12-3.GA_redhat_00002.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly-java-jdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.12-3.GA_redhat_00002.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly-java-jdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.12-3.GA_redhat_00002.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly-javadocs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.12-3.GA_redhat_00002.1.el7eap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.12-3.GA_redhat_00002.1.el7eap"}]}],"bundled":13}],"products":[{"vendor":"apache","product":"cxf"},{"vendor":"apache software foundation","product":"apache cxf"}],"references":[{"url":"https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c","tags":["vendor-advisory","x_transferred","Mailing List","Vendor Advisory","advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-46363","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3w37-5p3p-jv92"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/46xxx/CVE-2022-46363.json","tags":["advisory"]},{"url":"https://github.com/apache/cxf","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1043","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1601614","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1601617","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1701972","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1828406","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2031904","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2066009","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072009","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2073157","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105075","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2117506","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2126789","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2129706","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2129707","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2129709","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2135244","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2135247","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2135770","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2135771","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2138971","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2140597","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2141404","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2145194","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2148496","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2150009","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2155681","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2155682","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2155970","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2156263","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2156324","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2158585","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2160585","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1043.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-14040","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-14040","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14040","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-14042","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-14042","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14042","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-11358","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-11358","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11358","tags":["advisory"]},{"url":"https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/","tags":["article"]},{"url":"https://www.drupal.org/sa-core-2019-006","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-11022","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-11022","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11022","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gxr4-xjj5-5px2","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-11023","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1850004","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-11023","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11023","tags":["advisory"]},{"url":"https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/","tags":["article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-35065","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-35065","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35065","tags":["advisory"]},{"url":"https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44906","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44906","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44906","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xvch-5gv4-984h","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1274","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1274","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1274","tags":["advisory"]},{"url":"https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1438","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1438","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1438","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1471","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1471","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1471","tags":["advisory"]},{"url":"https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-2764","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2764","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2764","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-3916","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-3916","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3916","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-4137","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-4137","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4137","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-24785","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24785","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24785","tags":["advisory"]},{"url":"https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25857","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25857","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25857","tags":["advisory"]},{"url":"https://bitbucket.org/snakeyaml/snakeyaml/issues/525","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-31129","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-31129","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31129","tags":["advisory"]},{"url":"https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-37603","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-37603","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-37603","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-38749","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-38749","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38749","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-38750","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-38750","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38750","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-38751","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-38751","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38751","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-40149","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-40149","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40149","tags":["advisory"]},{"url":"https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-40150","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-40150","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40150","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-42003","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-42003","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42003","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-42004","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-42004","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42004","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-45047","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-45047","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45047","tags":["advisory"]},{"url":"https://www.mail-archive.com/dev@mina.apache.org/msg39312.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-45693","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-45693","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45693","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-46175","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-46175","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-46175","tags":["advisory"]},{"url":"https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-46363","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-46363","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-46364","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-46364","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-46364","tags":["advisory"]},{"url":"https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1\u0026modificationDate=1670944472739\u0026api=v2","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-0091","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-0091","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0091","tags":["advisory"]},{"url":"https://github.com/keycloak/keycloak/security/advisories/GHSA-v436-q368-hvgg","tags":["article"]},{"url":"https://github.com/keycloak/security/issues/27","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-0264","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-0264","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0264","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1044","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1044.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1045","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1045.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:1746","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1/html-single/installation_guide/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1815470","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1815495","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1816330","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1816332","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1816337","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1816340","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1937440","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1991305","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2030932","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2032580","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2135435","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2153379","tags":["report"]},{"url":"https://issues.redhat.com/browse/JBEAP-28583","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1746.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8840","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8840","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8840","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-9546","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-9546","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-9546","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-9547","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-9547","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-9547","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-9548","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-9548","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-9548","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-10672","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-10672","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10672","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-10673","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-10673","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10673","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-13936","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-13936","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13936","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3717","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3717","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3717","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44228","tags":["article"]},{"url":"https://access.redhat.com/security/vulnerabilities/RHSB-2021-009","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44228","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44228","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jfh8-c2jp-5v3q","tags":["advisory"]},{"url":"https://logging.apache.org/log4j/2.x/security.html","tags":["article"]},{"url":"https://www.lunasec.io/docs/blog/log4j-zero-day/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-45046","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-45046","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45046","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2021/12/14/4","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-41881","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-41881","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41881","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-42889","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-42889","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42889","tags":["advisory"]},{"url":"https://blogs.apache.org/security/entry/cve-2022-42889","tags":["article"]},{"url":"https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om","tags":["article"]},{"url":"https://seclists.org/oss-sec/2022/q4/22","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2025:1747","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2039403","tags":["report"]},{"url":"https://issues.redhat.com/browse/JBEAP-28581","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1747.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-42392","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-42392","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-42392","tags":["advisory"]},{"url":"https://github.com/h2database/h2database/security/advisories/GHSA-h376-j262-vhq6","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2022-46363","title":"Apache CXF directory listing / code exfiltration","description":"A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, and so the vulnerability can only arise if the CXF service is misconfigured.\n\n","status":"published","published":"2022-12-13T14:46:55.619Z","modified":"2025-04-22T02:50:45.431Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:34:32.156873Z"}],"euvd":[{"id":"EUVD-2022-7492","description":"A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, and so the vulnerability can only arise if the CXF service is misconfigured.\n\n","status":"published","published":"2022-12-13T14:46:55Z","modified":"2025-04-22T02:50:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T20:52:17.705566Z"}],"ghsa":[{"id":"GHSA-3w37-5p3p-jv92","title":"Apache CXF vulnerable to Exposure of Sensitive Information","description":"A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, and so the vulnerability can only arise if the CXF service is misconfigured.","status":"published","published":"2022-12-13T15:30:27Z","modified":"2023-09-07T14:48:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-20","CWE-200"],"updated_at":"2026-11-02T14:37:02.632342Z"}],"nvd":[{"id":"CVE-2022-46363","description":"A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, and so the vulnerability can only arise if the CXF service is misconfigured.\n\n","status":"published","published":"2022-12-13T15:15:11.677Z","modified":"2026-06-17T05:11:37.753Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:07:33.649381Z"}],"osv":[{"id":"CVE-2022-46363","title":"Apache CXF directory listing / code exfiltration","description":"A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, and so the vulnerability can only arise if the CXF service is misconfigured.\n\n","status":"published","published":"2022-12-13T14:46:55.619Z","modified":"2026-10-28T02:30:41.291401302Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:44:27.481647Z"},{"id":"GHSA-3w37-5p3p-jv92","title":"Apache CXF vulnerable to Exposure of Sensitive Information","description":"A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, and so the vulnerability can only arise if the CXF service is misconfigured.","status":"published","published":"2022-12-13T15:30:27Z","modified":"2024-02-16T08:04:58.630125Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-20","CWE-200"],"updated_at":"2026-11-02T15:46:36.092962Z"},{"id":"RHSA-2023:1043","title":"Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 7","status":"published","published":"2024-09-30T16:32:34Z","modified":"2026-10-13T10:03:51Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:1044","title":"Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 8","status":"published","published":"2024-09-30T16:32:14Z","modified":"2026-10-13T10:03:52Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:1045","title":"Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 9","status":"published","published":"2024-09-30T16:31:49Z","modified":"2026-10-13T10:03:53Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2025:1746","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.9 on RHEL 7 security update","status":"published","published":"2025-02-24T10:02:47Z","modified":"2026-10-14T10:08:34Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RHSA-2025:1747","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.12 security update","status":"published","published":"2025-02-24T10:02:48Z","modified":"2026-10-14T10:08:35Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"CLSA-2026-1776040410","title":"TuxCare security update for org.apache.cxf (6 CVEs)","description":"TuxCare rebuilt 5 org.apache.cxf packages to address 6 CVEs. Fixed in 3.4.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:24Z","modified":"2026-11-02T19:45:23.954889497Z","updated_at":"2026-11-02T20:30:40.499236Z"}]}}