Security Bulletin: WebSphere Application Server Liberty is vulnerable to server-side request forgery due to Apache CXF
Discription

## Summary

This security bulletin addresses the vulnerabilitiy in Open Source Apache CXF that affect IBM Tivoli Application Dependency Discovery Manager (CVE-2022-46364). IBM Tivoli Application Dependency Discovery Manager is using Apache CXF for its SOAP API and REST API implementation.

## Vulnerability Details

** CVEID: **[CVE-2022-46364]()
** DESCRIPTION: **Apache CXF is vulnerable to server-side request forgery, caused by a flaw in parsing the href attribute of XOP:Include in MTOM requests. By using a specially-crafted request, an attacker could exploit this vulnerability to conduct SSRF attack.
CVSS Base score: 7.5
CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/242008]() for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

## Affected Products and Versions

Affected Product(s)| Version(s)
—|—
IBM Tivoli Application Dependency Discovery Manager| 7.3.0.0 – 7.3.0.10

## Remediation/Fixes

**TADDM 7.3.0.5,7.3.0.8,7.3.0.9 and 7.3.0.10 : **The e-Fix in the table below can be downloaded and applied directly.

**TADDM 7.3.0.6 and 7.3.0.7 : **If there are existing eFixes on these versions (ls -lrt etc/efix*), please contact IBM support and open a case for a custom version of the e-Fixes. Include the current e-Fix level (ls -lrt etc.efix*), TADDM version and a link to this bulletin. The e-Fix in the table below is created to be installed on the respective FixPacks only if there are no previously applied e-Fixes.

**Fix **| **VRMF**| **APAR**|

**How to acquire fix**

—|—|—|—
efix_CVE-2022-46363-46364_FP5180802.zip| 7.3.0.5 | None| [Download eFix]( “Download eFix” )
efix_CVE-2022-46363-46364_FP6190313.zip| 7.3.0.6| None| [Download eFix]( “Download eFix” )
efix_CVE-2022-46363-46364_FP7200218.zip| 7.3.0.7| None| [Download eFix]( “Download eFix” )
efix_CVE-2022-46363-46364_FP10221123.zip| 7.3.0.8-7.3.0.10| None| [Download eFix]( “Download eFix” )

**Note:** Before TADDM 7.3.0.5, Java 7 was used and this CXF fix is applicable to Java 8. Hence, no e-Fix can be provided for versions before 7.3.0.5.

## Workarounds and Mitigations

For customers on TADDM 7.3.0.3 or 7.3.0.4, recommendation is to upgrade to the latest version and then apply the e-fix directly.

##Read More

Back to Main

Subscribe for the latest news: