GitHub Advisoryadvisory · Maven

GHSA-jq8c-j47c-vvwm Apache SOAP's RPCRouterServlet allows reading of arbitrary files over HTTP

HIGH Published 2022-09-23 Modified 2022-09-27 Official page ↗
Aliases
CVE-2022-40705
Ecosystem
Maven
Packages
soap:soap
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-611
Reviewed
2022-09-27

Affected packages

• Maven soap:soap: >= 2.2, <= 2.3.1 (no fix yet)

Description

An Improper Restriction of XML External Entity Reference vulnerability in RPCRouterServlet of Apache SOAP allows an attacker to read arbitrary files over HTTP. This issue affects Apache SOAP version 2.2 and later versions. It is unknown whether previous versions are also affected. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Related

Alias · CVE (1)

  • CVE-2022-40705 An Improper Restriction of XML External Entity Reference vulnerability in RPCRouterServlet of Apache SOAP allows an attacker to read… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References