Skip to content
OpenAdvisories

Package · Maven

soap:soap

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Critical 9.8
    CVE-2022-45378

    Apache SOAP allows unauthenticated users to potentially invoke arbitrary code

    In the default configuration of Apache SOAP, an RPCRouterServlet is available without authentication. This gives an attacker the possibility to invoke methods on the classpath that meet certain criteria. Depending on what classes are available on the classpat…

    Apache Software Foundation Apache SOAP soap:soap Maven
  • High 7.5
    CVE-2022-40705

    Apache SOAP: XML External Entity Injection (XXE) allows unauthenticated users to read arbitrary files via HTTP

    An Improper Restriction of XML External Entity Reference vulnerability in RPCRouterServlet of Apache SOAP allows an attacker to read arbitrary files over HTTP. This issue affects Apache SOAP version 2.2 and later versions. It is unknown whether previous versi…

    Apache Software Foundation Apache SOAP soap:soap Maven