CVE-2022-45378
Apache SOAP allows unauthenticated users to potentially invoke arbitrary code
Vexday Risk Score
28Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 9.8EPSS 2.3%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
14 Nov 2022Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
In the default configuration of Apache SOAP, an RPCRouterServlet is available without authentication. This gives an attacker the possibility to invoke methods on the classpath that meet certain criteria. Depending on what classes are available on the classpath this might even lead to arbitrary remote code execution. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Apache Software Foundation · Apache SOAPWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →