CVE-2022-40705

Published: Sep 22, 2022Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An Improper Restriction of XML External Entity Reference vulnerability in RPCRouterServlet of Apache SOAP allows an attacker to read arbitrary files over HTTP. This issue affects Apache SOAP version 2.2 and later versions. It is unknown whether previous versions are also affected. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Affected (1)

Products: Apache: Soap

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Soap	From 2.2

Related CWEs

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (4)

http://www.openwall.com/lists/oss-security/2022/09/22/1

Source: security@apache.org

Mailing ListThird Party Advisory

https://lists.apache.org/thread/02yo04w93rdjmllz4454lvodn5xzhwhl

Source: security@apache.org

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2022/09/22/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.apache.org/thread/02yo04w93rdjmllz4454lvodn5xzhwhl

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListVendor Advisory

Timeline

No history available yet.