Server-Side Request Forgery (SSRF) in Apache CXF - CVE-2022-46364

Vulnerability identifier: #VU70444

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N]

CVE-ID: CVE-2022-46364

CWE-ID: CWE-918

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input when parsing the href attribute of XOP:Include in MTOM requests. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

Apache CXF
Migration Toolkit for Runtimes
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Intelligent Operations Center
Red Hat Migration Toolkit for Applications
IBM Tivoli Netcool Impact
IBM TXSeries for Multiplatforms
Oracle Communications Diameter Signaling Router
IBM Common Licensing
Oracle Communications Session Report Manager
IBM Operations Analytics Predictive Insights
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Match 360
IBM Spectrum Control
IBM Sterling B2B Integrator
IBM Tivoli Business Service Manager
IBM Cloud Application Performance Management (APM)
Maximo Manage Application in IBM Maximo Application Suite
IBM Maximo Application Suite
IBM Security Verify Governance
IBM Business Automation Workflow
Red Hat Camel for Spring Boot
IBM CICS TX Advanced
IBM CICS TX Standard
Oracle BI Publisher
IBM Business Automation Manager Open Editions
InfoSphere Data Architect
Oracle Banking Digital Experience
PowerVM NovaLink
IBM ECM Content Management Interoperability Services
JBoss Enterprise Application Platform
Fuse
IBM WebSphere Application Server Liberty
IBM i
IBM Tivoli Application Dependency Discovery Manager
Oracle Communications Element Manager
Oracle Banking Corporate Lending Process Management
Oracle Banking Liquidity Management
Oracle Banking Trade Finance Process Management
Oracle Banking Origination
Oracle Banking Supply Chain Finance
Oracle Banking Cash Management
Oracle Banking Credit Facilities Process Management
IBM Data Risk Manager
Cloudera Data Platform Private Cloud Base for IBM
Red Hat Single Sign-On
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
Oracle Communications Instant Messaging Server
Voice Gateway
Zimbra Collaboration
Oracle Commerce Platform
eap7-jboss-annotations (Red Hat package)
eap7-jboss-jsp (Red Hat package)
eap7-jboss-jsf (Red Hat package)
eap7-javaee-security-soteria (Red Hat package)
eap7-log4j-jboss-logmanager (Red Hat package)
eap7-h2database (Red Hat package)
eap7-jettison (Red Hat package)
eap7-ironjacamar (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-avro (Red Hat package)
eap7-elytron-web (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
eap7-bouncycastle (Red Hat package)
eap7-jboss-marshalling (Red Hat package)
eap7-xml-security (Red Hat package)
eap7-undertow (Red Hat package)
eap7-wss4j (Red Hat package)
eap7-xalan-j2 (Red Hat package)
eap7-jackson-databind (Red Hat package)
eap7-apache-sshd (Red Hat package)
eap7-jackson-core (Red Hat package)
eap7-jackson-jaxrs-providers (Red Hat package)
eap7-jackson-modules-base (Red Hat package)
eap7-jackson-modules-java8 (Red Hat package)
eap7-jackson-annotations (Red Hat package)
eap7-apache-cxf (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-jboss-xnio-base (Red Hat package)
eap7-jboss-ejb-client (Red Hat package)
eap7-jboss-remoting (Red Hat package)
eap7-hibernate-search (Red Hat package)
eap7-woodstox-core (Red Hat package)
eap7-wildfly (Red Hat package)
rh-sso7-keycloak (Red Hat package)
Liberty for Java for IBM Cloud
IBM Sterling Global Mailbox (GM)
IBM Qradar SIEM
IBM Security Verify Access
IBM Cognos Analytics

Install updates from vendor's website.

Apache CXF - addressed in versions 3.4.10, 3.5.5
Migration Toolkit for Runtimes - update to 1.0.2
Red Hat Camel for Spring Boot - addressed in versions 3.14.5 Patch 1, 3.18.3 Patch 2
IBM Intelligent Operations Center - update to 5.2.4
Red Hat Migration Toolkit for Applications - update to 6.1.0
IBM Tivoli Netcool Impact - update to 7.1.0.30
JBoss Enterprise Application Platform - addressed in versions 7.1.8, 7.3.11, 7.4.9
Red Hat Single Sign-On - update to 7.6.2
Fuse - addressed in versions 7.11.1.P1, 7.12.0
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.13.3
IBM Business Automation Manager Open Editions - update to 8.0.3
Zimbra Collaboration - addressed in versions 8.8.15 Patch 40, 9.0.0 Patch 33, 10.0.1
InfoSphere Data Architect - update to 9.2.1
Oracle Banking Corporate Lending Process Management - update to 14.7.0.0.0
eap7-jboss-annotations (Red Hat package) - update to api_1.3_spec-2.0.1-4.Final_redhat_00001.1.el7eap
eap7-jboss-jsp (Red Hat package) - addressed in versions api_2.3_spec-2.0.0-3.Final_redhat_00001.1.el7eap, api_2.3_spec-2.0.0-3.Final_redhat_00001.1.el8eap, api_2.3_spec-2.0.0-3.Final_redhat_00001.1.el9eap
eap7-jboss-jsf (Red Hat package) - addressed in versions api_2.3_spec-3.0.0-6.SP07_redhat_00001.1.el7eap, api_2.3_spec-3.0.0-6.SP07_redhat_00001.1.el8eap, api_2.3_spec-3.0.0-6.SP07_redhat_00001.1.el9eap
eap7-javaee-security-soteria (Red Hat package) - addressed in versions 1.0.1-3.redhat_00003.1.el7eap, 1.0.1-3.redhat_00003.1.el8eap, 1.0.1-3.redhat_00003.1.el9eap
Voice Gateway - addressed in versions 1.0.8.2, 1.0.8.6
eap7-log4j-jboss-logmanager (Red Hat package) - update to 1.2.2-2.Final_redhat_00002.1.el7eap
IBM Operations Analytics Predictive Insights - update to 1.3.6.6
eap7-h2database (Red Hat package) - addressed in versions 1.4.197-2.redhat_00005.1.ep7.el7, 1.4.197-3.redhat_00004.1.el7eap
eap7-jettison (Red Hat package) - addressed in versions 1.5.2-1.redhat_00002.1.el7eap, 1.5.2-1.redhat_00002.1.el8eap, 1.5.2-1.redhat_00002.1.el9eap
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.10-1.Final_redhat_00001.1.el7eap, 1.5.10-1.Final_redhat_00001.1.el8eap, 1.5.10-1.Final_redhat_00001.1.el9eap
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.7.2-12.Final_redhat_00013.1.el7eap, 1.10.0-24.Final_redhat_00023.1.el7eap, 1.10.0-24.Final_redhat_00023.1.el8eap, 1.10.0-24.Final_redhat_00023.1.el9eap
eap7-avro (Red Hat package) - addressed in versions 1.7.6-2.redhat_00003.1.ep7.el7, 1.7.6-8.redhat_00003.1.el7eap
eap7-elytron-web (Red Hat package) - addressed in versions 1.9.3-1.Final_redhat_00001.1.el7eap, 1.9.3-1.Final_redhat_00001.1.el8eap, 1.9.3-1.Final_redhat_00001.1.el9eap
eap7-wildfly-elytron (Red Hat package) - addressed in versions 1.15.16-1.Final_redhat_00001.1.el7eap, 1.15.16-1.Final_redhat_00001.1.el8eap, 1.15.16-1.Final_redhat_00001.1.el9eap
eap7-bouncycastle (Red Hat package) - update to 1.68.0-1.redhat_00005.1.ep7.el7
PowerVM NovaLink - addressed in versions 2.0.1-230412, 2.0.3.1.1-230413, 2.1.1-230424
IBM Data Risk Manager - update to 2.0.6.16
eap7-jboss-marshalling (Red Hat package) - addressed in versions 2.0.15-1.Final_redhat_00001.1.el7eap, 2.0.15-1.Final_redhat_00001.1.ep7.el7
eap7-xml-security (Red Hat package) - addressed in versions 2.2.3-1.redhat_00001.1.el7eap, 2.2.3-1.redhat_00001.1.el8eap, 2.2.3-1.redhat_00001.1.el9eap, 2.2.3-2.redhat_00001.1.el7eap
eap7-undertow (Red Hat package) - addressed in versions 2.2.22-1.SP3_redhat_00001.1.el7eap, 2.2.22-1.SP3_redhat_00001.1.el8eap, 2.2.22-1.SP3_redhat_00001.1.el9eap
eap7-wss4j (Red Hat package) - addressed in versions 2.3.3-1.redhat_00001.1.el7eap, 2.3.3-1.redhat_00001.1.el8eap, 2.3.3-1.redhat_00001.1.el9eap, 2.3.3-2.redhat_00001.1.el7eap
eap7-xalan-j2 (Red Hat package) - addressed in versions 2.7.1-26.redhat_00015.1.ep7.el7, 2.7.1-38.redhat_00015.1.el7eap
eap7-jackson-databind (Red Hat package) - addressed in versions 2.8.11.6-1.SP1_redhat_00001.1.ep7.el7, 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-apache-sshd (Red Hat package) - addressed in versions 2.9.2-1.redhat_00001.1.el7eap, 2.9.2-1.redhat_00001.1.el8eap, 2.9.2-1.redhat_00001.1.el9eap
eap7-jackson-core (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-jaxrs-providers (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-modules-base (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-modules-java8 (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-annotations (Red Hat package) - addressed in versions 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
IBM ECM Content Management Interoperability Services - update to 3.0.7.0.2
eap7-apache-cxf (Red Hat package) - addressed in versions 3.1.16-3.SP1_redhat_00001.1.ep7.el7, 3.4.10-1.SP1_redhat_00001.1.el7eap, 3.4.10-1.redhat_00001.1.el7eap, 3.4.10-1.redhat_00001.1.el8eap, 3.4.10-1.redhat_00001.1.el9eap
eap7-hal-console (Red Hat package) - addressed in versions 3.3.16-1.Final_redhat_00001.1.el7eap, 3.3.16-1.Final_redhat_00001.1.el8eap, 3.3.16-1.Final_redhat_00001.1.el9eap
eap7-jboss-xnio-base (Red Hat package) - addressed in versions 3.5.10-1.Final_redhat_00001.1.ep7.el7, 3.7.13-1.Final_redhat_00001.1.el7eap
Liberty for Java for IBM Cloud - update to 3.79-20230223-2310
eap7-jboss-ejb-client (Red Hat package) - addressed in versions 4.0.49-1.Final_redhat_00001.1.el7eap, 4.0.49-1.Final_redhat_00001.1.el8eap, 4.0.49-1.Final_redhat_00001.1.el9eap
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.6.5
IBM Watson Knowledge Catalog in Cloud Pak for Data - update to 4.7
IBM Match 360 - update to 4.7.0
eap7-jboss-remoting (Red Hat package) - addressed in versions 5.0.27-1.Final_redhat_00001.1.el7eap, 5.0.27-1.Final_redhat_00001.1.el8eap, 5.0.27-1.Final_redhat_00001.1.el9eap
IBM Spectrum Control - update to 5.4.10.1
eap7-hibernate-search (Red Hat package) - addressed in versions 5.10.13-3.Final_redhat_00001.1.el7eap, 5.10.13-3.Final_redhat_00001.1.el8eap, 5.10.13-3.Final_redhat_00001.1.el9eap
IBM Sterling Global Mailbox (GM) - addressed in versions 6.0.3.8, 6.1.2.2
IBM Sterling B2B Integrator - addressed in versions 6.1.2.5, 6.2.0.1
IBM Tivoli Business Service Manager - update to 6.2.0.5
eap7-woodstox-core (Red Hat package) - addressed in versions 6.4.0-1.redhat_00001.1.el7eap, 6.4.0-1.redhat_00001.1.el8eap, 6.4.0-1.redhat_00001.1.el9eap
eap7-wildfly (Red Hat package) - addressed in versions 7.1.8-2.GA_redhat_00002.1.ep7.el7, 7.3.11-4.GA_redhat_00002.1.el7eap, 7.4.9-4.GA_redhat_00003.1.el7eap, 7.4.9-4.GA_redhat_00003.1.el8eap, 7.4.9-4.GA_redhat_00003.1.el9eap
Cloudera Data Platform Private Cloud Base for IBM - update to 7.1.9.3 HF2
IBM Qradar SIEM - addressed in versions 7.4.3 Fix Pack 9, 7.5.0 Update Pack 5
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.14
Maximo Manage Application in IBM Maximo Application Suite - addressed in versions 8.5.6, 8.6.2
IBM Maximo Application Suite - addressed in versions 8.9.3, 8.10.0
IBM Security Verify Governance - update to 10.0.1.0.5
IBM Security Verify Access - update to 10.0.7.0
IBM Cognos Analytics - addressed in versions 11.2.4 Fix Pack 2, 12.0.1
rh-sso7-keycloak (Red Hat package) - addressed in versions 18.0.6-1.redhat_00001.1.el7sso, 18.0.6-1.redhat_00001.1.el8sso, 18.0.6-1.redhat_00001.1.el9sso
IBM Business Automation Workflow - addressed in versions 21.0.3 IF019, 22.0.2 IF003

• https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1&modificationDate=1670944472739&api=v2

• Multiple vulnerabilities in Apache CXF
• Red Hat JBoss Enterprise Application Platform 7.4 update for Apache CXF
• Multiple vulnerabilities in IBM Tivoli Application Dependency Discovery Manager
• Multiple vulnerabilities in Red Hat Fuse 7.11
• Information disclosure in Red Hat Camel for Spring Boot
• Multiple vulnerabilities in IBM Voice Gateway
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4
• Multiple vulnerabilities in JBoss Enterprise Application Platform 7.4 for RHEL 7
• Multiple vulnerabilities in JBoss Enterprise Application Platform 7.4 for RHEL 8
• Multiple vulnerabilities in JBoss Enterprise Application Platform 7.4 for RHEL 9
• IBM WebSphere Application Server Liberty update for Apache CXF
• Multiple vulnerabilities in IBM Operations Analytics Predictive Insights
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for OpenShift
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 9
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 8
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 7
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Server-side request forgery in IBM Liberty for Java for IBM Cloud
• IBM CICS TX Advanced update for Apache CXF
• IBM CICS TX Standard update for Apache CXF
• IBM TXSeries for Multiplatforms update for Apache CXF
• Multiple vulnerabilities in Migration Toolkit for Runtimes
• Multiple vulnerabilities in Migration Toolkit for Runtimes
• IBM sterling global mailbox in IBM Sterling Global Mailbox
• Server-side request forgery in IBM Business Automation Workflow
• Multiple vulnerabilities in Oracle Banking Digital Experience
• Multiple vulnerabilities in Oracle Communications Session Report Manager
• Multiple vulnerabilities in Oracle Communications Element Manager
• Multiple vulnerabilities in Oracle Communications Diameter Signaling Router
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications
• Server-side request forgery in IBM Tivoli Business Service Manager
• Multiple vulnerabilities in IBM i
• Server-side request forgery in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM ECM Content Management Interoperability Services (CMIS)
• Server-side request forgery in IBM Maximo Application Suite - Monitor Component
• Server-side request forgery in IBM PowerVM Novalink
• Multiple vulnerabilities in Zimbra Collaboration
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in Red Hat Integration Camel for Spring Boot
• Server-side request forgery in IBM Spectrum Control
• Server-side request forgery in IBM Tivoli Netcool Impact
• Server-Side Request Forgery (SSRF) in IBM Match 360
• Multiple vulnerabilities in IBM Maximo Application Suite - Manage Component
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in Oracle Communications Messaging Server
• Multiple vulnerabilities in Oracle BI Publisher
• Multiple vulnerabilities in IBM Watson Knowledge Catalog for IBM Cloud Pak for Data
• Server-Side Request Forgery (SSRF) in IBM Intelligent Operations Center
• Multiple vulnerabilities in IBM Application Performance Management
• Multiple vulnerabilities in IBM Cognos Analytics
• Multiple vulnerabilities in Red Hat Process Automation Manager 7.13
• Multiple vulnerabilities in IBM Data Risk Manager
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM Security Verify Access
• Multiple vulnerabilities in IBM Common Licensing
• Multiple vulnerabilities in IBM Sterling B2B Integrator
• Multiple vulnerabilities in Oracle Commerce Platform
• Multiple vulnerabilities in Cloudera Data Platform Private Cloud Base with IBM (CDP)
• Server-side request forgery in IBM Security Guardium Key Lifecycle Manager (SKLM/GKLM)
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7
• Multiple vulnerabilities in Fuse 7
• Multiple vulnerabilities in Oracle Banking Supply Chain Finance
• Multiple vulnerabilities in Oracle Banking Trade Finance Process Management
• Multiple vulnerabilities in Oracle Banking Corporate Lending Process Management
• Multiple vulnerabilities in Oracle Banking Credit Facilities Process Management
• Multiple vulnerabilities in Oracle Banking Origination
• Multiple vulnerabilities in Oracle Banking Liquidity Management
• Multiple vulnerabilities in Oracle Banking Cash Management
• Multiple vulnerabilities in IBM InfoSphere Data Architect