Information disclosure in Apache CXF - CVE-2022-46363

Vulnerability identifier: #VU70443

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-46363

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. A remote attacker can gain list directories on the system or exfiltrate code.

Apache CXF
Red Hat Camel for Spring Boot
IBM Intelligent Operations Center
Red Hat Integration Camel-K
IBM Sterling B2B Integrator
IBM Tivoli Business Service Manager
IBM Security Verify Governance
JBoss Enterprise Application Platform
Fuse
IBM Tivoli Application Dependency Discovery Manager
IBM Data Risk Manager
Red Hat Single Sign-On
InfoSphere Data Architect
IBM ECM Content Management Interoperability Services
IBM Security Guardium
Voice Gateway
eap7-jettison (Red Hat package)
eap7-velocity (Red Hat package)
eap7-snakeyaml (Red Hat package)
eap7-jackson-databind (Red Hat package)
eap7-jackson-annotations (Red Hat package)
eap7-jackson-modules-java8 (Red Hat package)
eap7-jackson-core (Red Hat package)
eap7-jackson-jaxrs-providers (Red Hat package)
eap7-jackson-modules-base (Red Hat package)
eap7-resteasy (Red Hat package)
eap7-apache-cxf (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-netty (Red Hat package)
eap7-wildfly (Red Hat package)
rh-sso7-keycloak (Red Hat package)
IBM Sterling Global Mailbox (GM)
IBM Qradar SIEM

Install updates from vendor's website.

Apache CXF - addressed in versions 3.4.10, 3.5.5
Red Hat Camel for Spring Boot - addressed in versions 3.14.5 Patch 1, 3.18.3 Patch 2
IBM Intelligent Operations Center - update to 5.2.4
JBoss Enterprise Application Platform - addressed in versions 7.1.9, 7.3.12
Red Hat Single Sign-On - update to 7.6.2
Fuse - addressed in versions 7.11.1.P1, 7.12.0
InfoSphere Data Architect - update to 9.2.1
Voice Gateway - addressed in versions 1.0.8.2, 1.0.8.6
eap7-jettison (Red Hat package) - addressed in versions 1.3.8-2.redhat_00002.1.ep7.el7, 1.5.2-2.redhat_00002.1.el7eap
eap7-velocity (Red Hat package) - update to 1.7.0-3.redhat_00006.1.ep7.el7
Red Hat Integration Camel-K - update to 1.10.1
eap7-snakeyaml (Red Hat package) - addressed in versions 1.33.0-1.SP1_redhat_00001.1.el7eap, 1.33.0-1.SP1_redhat_00001.1.ep7.el7
IBM Data Risk Manager - update to 2.0.6.16
eap7-jackson-databind (Red Hat package) - addressed in versions 2.8.11.6-2.SP1_redhat_00002.1.ep7.el7, 2.10.4-4.redhat_00004.1.el7eap
eap7-jackson-annotations (Red Hat package) - update to 2.10.4-2.redhat_00004.1.el7eap
eap7-jackson-modules-java8 (Red Hat package) - update to 2.10.4-2.redhat_00004.1.el7eap
eap7-jackson-core (Red Hat package) - update to 2.10.4-2.redhat_00004.1.el7eap
eap7-jackson-jaxrs-providers (Red Hat package) - update to 2.10.4-2.redhat_00004.1.el7eap
eap7-jackson-modules-base (Red Hat package) - update to 2.10.4-4.redhat_00004.1.el7eap
IBM ECM Content Management Interoperability Services - update to 3.0.7.0.2
eap7-resteasy (Red Hat package) - addressed in versions 3.0.27-1.Final_redhat_00001.1.ep7.el7, 3.11.6-1.Final_redhat_00001.1.el7eap
eap7-apache-cxf (Red Hat package) - update to 3.1.16-4.redhat_00003.1.ep7.el7
eap7-hal-console (Red Hat package) - update to 3.2.17-1.Final_redhat_00001.1.el7eap
eap7-netty (Red Hat package) - addressed in versions 4.1.63-1.Final_redhat_00002.1.ep7.el7, 4.1.63-4.Final_redhat_00002.1.el7eap
IBM Sterling Global Mailbox (GM) - addressed in versions 6.0.3.8, 6.1.2.2
IBM Sterling B2B Integrator - addressed in versions 6.1.2.5, 6.2.0.1
IBM Tivoli Business Service Manager - update to 6.2.0.5
eap7-wildfly (Red Hat package) - addressed in versions 7.1.9-2.GA_redhat_00002.1.ep7.el7, 7.3.12-3.GA_redhat_00002.1.el7eap
IBM Qradar SIEM - addressed in versions 7.4.3 Fix Pack 9, 7.5.0 Update Pack 5
IBM Security Verify Governance - update to 10.0.2
rh-sso7-keycloak (Red Hat package) - addressed in versions 18.0.6-1.redhat_00001.1.el7sso, 18.0.6-1.redhat_00001.1.el8sso, 18.0.6-1.redhat_00001.1.el9sso

• https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c

• Multiple vulnerabilities in Apache CXF
• Multiple vulnerabilities in IBM Tivoli Application Dependency Discovery Manager
• Multiple vulnerabilities in Red Hat Fuse 7.11
• Information disclosure in Red Hat Camel for Spring Boot
• Multiple vulnerabilities in IBM Voice Gateway
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for OpenShift
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 9
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 8
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 7
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Information disclosure in IBM Sterling Global Mailbox
• Information disclosure in IBM Tivoli Business Service Manager
• Multiple vulnerabilities in IBM ECM Content Management Interoperability Services (CMIS)
• Multiple vulnerabilities in Red Hat Integration Camel for Spring Boot
• Multiple vulnerabilities in Red Hat Integration Camel K
• Information disclosure in IBM Intelligent Operations Center
• Multiple vulnerabilities in IBM Data Risk Manager
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM Security Guardium
• Multiple vulnerabilities in IBM Sterling B2B Integrator
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in Fuse 7
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7
• IBM InfoSphere Data Architect update for Apache CXF