What is GHSA-jq8c-j47c-vvwm?

GHSA-jq8c-j47c-vvwm is a security advisory published by GitHub Security Advisories with High severity. Apache SOAP's RPCRouterServlet allows reading of arbitrary files over HTTP

Which CVE IDs does GHSA-jq8c-j47c-vvwm cover?

GHSA-jq8c-j47c-vvwm covers the following CVE IDs: CVE-2022-40705. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jq8c-j47c-vvwm?

GHSA-jq8c-j47c-vvwm has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-jq8c-j47c-vvwm?

GHSA-jq8c-j47c-vvwm affects 1 product, including: maven/soap:soap:\u003e= 2.2, \u003c= 2.3.1.

GHSA-jq8c-j47c-vvwmHighCVSS 7.5

Apache SOAP's RPCRouterServlet allows reading of arbitrary files over HTTP

Vendor

GitHub Security Advisories

Published

September 23, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-40705 →

📋 Description

An Improper Restriction of XML External Entity Reference vulnerability in RPCRouterServlet of Apache SOAP allows an attacker to read arbitrary files over HTTP. This issue affects Apache SOAP version 2.2 and later versions. It is unknown whether previous versions are also affected. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

🎯 Affected products1

maven/soap:soap:>= 2.2, <= 2.3.1

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2022-40705
https://lists.apache.org/thread/02yo04w93rdjmllz4454lvodn5xzhwhl
http://www.openwall.com/lists/oss-security/2022/09/22/1
https://github.com/advisories/GHSA-jq8c-j47c-vvwm