CVE-2022-40705CWE-611

Apache SOAP: XML External Entity Injection (XXE) allows unauthenticated users to read arbitrary files via HTTP

High · published September 22, 2022

CVSS v3.1
7.5
EPSS
2%
Percentile
79.7
In the wild
Unconfirmed
What it is

An Improper Restriction of XML External Entity Reference vulnerability in RPCRouterServlet of Apache SOAP allows an attacker to read arbitrary files over HTTP. This issue affects Apache SOAP version 2.2 and later versions. It is unknown whether previous versions are also affected. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01918 · 79.7th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2022-09-22T08:15Z
EPSS history
Timeline
  • 22 SEP 08:15Z
    Apache SOAP: XML External Entity Injection (XXE) allows unauthenticated users to read arbitrary files via HTTP
    cvelistv5