Medium severity · published Aug 2, 2018
CVE-2018-8032
Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services
6.1
CVSS
10.6%
EPSS
No
On KEV
Description
Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)10.6% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Apache Axis · Apache Software Foundation
1.x up to and including 1.4 · source: vendor
AE
Agile Engineering Data Management · Oracle
6.2.1.0 · source: NVD
AP
Agile Product Lifecycle Management · Oracle
9.3.3 · source: NVD
AT
Application Testing Suite · Oracle
13.2.0.1; 13.3.0.1 · source: NVD
AX
Axis · Apache
1.0 through 1.4 · source: NVD
BD
Big Data Discovery · Oracle
1.6 · source: NVD
CA
Communications Asap Cartridges · Oracle
7.2; 7.3 · source: NVD
CD
Communications Design Studio · Oracle
7.3.4.3.0; 7.3.5.5.0; 7.4.0.4.0; 7.4.1.1.0 · source: NVD
CE
Communications Element Manager · Oracle
8.0.0; 8.1.0; 8.1.1; 8.2.0 · source: NVD
CN
Communications Network Integrity · Oracle
7.3.5; 7.3.6 · source: NVD
CO
Communications Order And Service Management · Oracle
7.3.0.0.0; 7.4 · source: NVD
CS
Communications Session Report Manager · Oracle
8.0.0; 8.1.0; 8.1.1; 8.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-8032
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-8032
mail-archives.apache.org
http://mail-archives.apache.org/mod_mbox/axis-java-dev/201807.mbox/%3CJIRA.13170716.1531060536000.93536.1531060560060%40Atlassian.JIRA%3E
Issue Tracking
https://issues.apache.org/jira/browse/AXIS-2924
lists.apache.org
https://lists.apache.org/thread.html/3b89bc9e9d055db7eba8835ff6501f3f5db99d2a0928ec0be9b1d17b%40%3Cjava-dev.axis.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/d06ed5e4eeb77d00e8d594ec01ee8ee1cba173a01ac4b18f1579d041%40%3Cjava-dev.axis.apache.org%3E
Mailing List
https://lists.debian.org/debian-lts-announce/2021/11/msg00015.html
security.netapp.com
https://security.netapp.com/advisory/ntap-20240621-0006/