CVE-2022-46363: Apache CXF Exposure of Sensitive Information
Summary
CVE-2022-46363: Apache CXF vulnerable to Exposure of Sensitive Information. Affects org.apache.cxf:cxf-core across 2 version ranges.
< 3.4.10
>= 3.5.0, < 3.5.5
Fixed in 3.4.10 or 3.5.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache CXF is an open-source web services framework that allows developers to build and deploy services using various protocols and data formats. It provides a comprehensive set of features for developing SOAP and RESTful applications. The vulnerability in Apache CXF versions before 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. This vulnerability arises when the CXFServlet is misconfigured with both the static-resources-list and redirect-query-check attributes, which are not supposed to be used together.
Vulnerability Detail
The vulnerability in Apache CXF allows an attacker to exploit a misconfiguration in the CXFServlet to perform a remote directory listing or code exfiltration. By combining the static-resources-list and redirect-query-check attributes, an attacker can bypass intended security measures and gain unauthorized access to sensitive information. This can lead to the exposure of sensitive data or the exfiltration of code, potentially compromising the integrity and confidentiality of the affected system.
How To Fix
Latest published version: 4.2.4 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.4.103.4.10 -
>= 3.5.0, < 3.5.53.5.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, users can mitigate the risk by ensuring that the CXFServlet is properly configured and that the static-resources-list and redirect-query-check attributes are not used together. Regularly reviewing and updating the configuration of Apache CXF can also help in preventing misconfigurations that could lead to similar vulnerabilities.
Conclusion
The vulnerability in Apache CXF exposes sensitive information and can lead to remote directory listing or code exfiltration. It is crucial to update to the patched versions of Apache CXF and ensure proper configuration to mitigate the risk. Regularly reviewing and updating the configuration can help prevent similar vulnerabilities in the future. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.cxf:cxf-core →
FAQ
Apache CXF is an open-source web services framework that allows developers to build and deploy services using various protocols and data formats.
This vulnerability allows an attacker to perform a remote directory listing or code exfiltration, potentially exposing sensitive information and compromising the affected system's integrity and confidentiality.
To fix this vulnerability, update Apache CXF to version 3.5.5 or 3.4.10 and ensure proper configuration of the CXFServlet, avoiding the use of both the static-resources-list and redirect-query-check attributes together.
While there is no specific workaround provided, users can mitigate the risk by following the recommended steps for fixing the vulnerability and regularly reviewing and updating the configuration of Apache CXF.
For further information and support on vulnerability remediation, you can contact info@devnack.com.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.cxf:cxf-core.
