High severity · published May 1, 2019
CVE-2019-0227
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006
7.5
CVSS
91.9%
EPSS
No
On KEV
Description
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)91.9% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AE
Agile Engineering Data Management · Oracle
6.2.1.0 · source: NVD
AP
Agile Product Lifecycle Management · Oracle
9.3.3 · source: NVD
AT
Application Testing Suite · Oracle
13.2.0.1; 13.3.0.1 · source: NVD
AX
Axis · Apache
1.4 · source: NVD
BD
Big Data Discovery · Oracle
1.6 · source: NVD
CA
Communications Asap Cartridges · Oracle
7.2; 7.3 · source: NVD
CD
Communications Design Studio · Oracle
7.3.4.3.0; 7.3.5.5.0; 7.4.0.4.0; 7.4.1.1.0 · source: NVD
CE
Communications Element Manager · Oracle
8.0.0; 8.1.0; 8.1.1; 8.2.0 · source: NVD
CN
Communications Network Integrity · Oracle
7.3.5; 7.3.6 · source: NVD
CO
Communications Order And Service Management · Oracle
7.3.0.0.0; 7.4 · source: NVD
CS
Communications Session Report Manager · Oracle
8.0.0; 8.1.0; 8.1.1; 8.2.0 · source: NVD
CS
Communications Session Route Manager · Oracle
8.0.0; 8.1.0; 8.1.1; 8.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-0227
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-0227
lists.apache.org
https://lists.apache.org/thread.html/r3a5baf5d76f1f2181be7f54da3deab70d7a38b5660b387583d05a8cd%40%3Cjava-user.axis.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E
Exploit
https://rhinosecuritylabs.com/application-security/cve-2019-0227-expired-domain-rce-apache-axis/
security.netapp.com
https://security.netapp.com/advisory/ntap-20240621-0006/
Patch
https://www.oracle.com/security-alerts/cpuApr2021.html
Patch
https://www.oracle.com/security-alerts/cpuapr2020.html
More from Axis
9.8
CVE-2023-40743
** UNSUPPORTED WHEN ASSIGNED ** When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through "ServiceFactory.getService"…
7.2
CVE-2023-51441
** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Axis allowed users with access to the admin service to perform possible SSRF This issue affects…
6.1
CVE-2018-8032
Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services
–
CVE-2014-3596
The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field…
–
CVE-2012-5784
Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ,…