CVE-2019-0227GHSA-H9GJ-RQRW-X4FQ
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 on Exploit-DB, 2 proofs of concept on GitHub
Summary
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.
Timeline
- Public exploit on Exploit-DB
EDB-46682
- CVE published
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- Apache Apache Axis 1.4
Apache Axis 1.4
- org.apache.axis:axisMaven
through 1.4
- axis:axisMaven
through 1.4
References 16
rhinosecuritylabs.com
lists.apache.org
oracle.com
- security-alerts/cpuapr2020.html
- security-alerts/cpujul2020.html
- technetwork/security-advisory/cpuoct2019-5072832.html
- security-alerts/cpujan2020.html
- security-alerts/cpujan2021.html
- security-alerts/cpuApr2021.html
- security-alerts/cpuoct2021.html
- security-alerts/cpuapr2022.html
- security-alerts/cpujul2022.html