CVE-2022-46363: Improper Input Validation

December 13, 2022 (updated November 9, 2023)

A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, and so the vulnerability can only arise if the CXF service is misconfigured.

References

github.com/advisories/GHSA-3w37-5p3p-jv92
lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c
nvd.nist.gov/vuln/detail/CVE-2022-46363

Code Behaviors & Features

Detect and mitigate CVE-2022-46363 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →