CVE-2022-45378

 

Published at: - 14-11-2022 03:15

Last modified: - 16-11-2022 07:57

Total changes: - 2

Description

** UNSUPPORTED WHEN ASSIGNED ** In the default configuration of Apache SOAP, an RPCRouterServlet is available without authentication. This gives an attacker the possibility to invoke methods on the classpath that meet certain criteria. Depending on what classes are available on the classpath this might even lead to arbitrary remote code execution. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• N/A-Mailing List, Vendor Advisory
• [oss-security] 20221114 CVE-2022-45378: Apache SOAP allows unauthenticated users to potentially invoke arbitrary code-Mailing List, Third Party Advisory

 

Keywords

NVD

 

CVE-2022-45378

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures