CVE-2022-46364

—

CVSS 3.1

9.8 critical

EPSS

2%p83

Published

Dec 13, 2022 (Dec 13, 2022)

Modified

Jun 17, 2026

Description

A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.

Vendors: apache
Products: cxf
Weakness: CWE-918
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (2.4%)

In the news0 stories

No ingested article mentions this CVE yet.