Skip to main content

Missing Authentication for Critical Function

CVE-2022-45378

High
9.8/10

Summary

In the default configuration of Apache SOAP, an RPCRouterServlet is available without authentication. This gives an attacker the possibility to invoke methods on the 'classpath' that meet certain criteria. Depending on what classes are available on the 'classpath' this might even lead to arbitrary Remote Code Execution (RCE). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • HIGH

CWE-306 - Missing Authentication for Critical Function

The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References

Advisory Timeline

  • Published