Apache Soap vulnerabilities

2 CVEs affecting Apache Soap, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-45378, published 2022-11-14.

More from Apache.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-45378, published 2022-11-14. Critical severity, CVSS 9.8. EPSS: 2.4% chance of exploitation in the next 30 days. In the default configuration of Apache SOAP, an RPCRouterServlet is available without authentication. This gives an attacker the possibility to invoke methods on the classpath that meet certain…
• CVE-2022-40705, published 2022-09-22. High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days. An Improper Restriction of XML External Entity Reference vulnerability in RPCRouterServlet of Apache SOAP allows an attacker to read arbitrary files over HTTP. This issue affects Apache SOAP version…