PT-2019-3928 · Apache+1 · Apache Axis2+2

Published 2019-01-15 · Updated 2024-06-21 · CVE-2019-0227

Positive Technologies (AI Summary)

CVSS v2.0

7.9

High

Base vector

AV:A/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Axis version 1.4

Description The issue is related to insufficient validation of incoming requests, which can allow a remote attacker to perform a Server Side Request Forgery (SSRF) attack. The vulnerability affects the Apache Axis 1.4 distribution, which was last released in 2006.

Recommendations For Apache Axis version 1.4, legacy users are encouraged to build from source to address the issue. As a temporary workaround, consider restricting access to vulnerable API endpoints until a patch is available. Note that the successor to Axis 1.x, Axis2, with its latest version 1.7.9, is not vulnerable to this issue. At the moment, there is no information about a newer version of Apache Axis 1.4 that contains a fix for this vulnerability.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2019-04406

CVE-2019-0227

GHSA-H9GJ-RQRW-X4FQ

Affected Products

Apache Axis

Apache Axis2

Debian

References · 33

• 🔥 https://github.com/ianxtianxt/cve-2019-0227 · Exploit
• 🔥 https://rhinosecuritylabs.com/application-security/cve-2019-0227-expired-domain-rce-apache-axis · Exploit
• 🔥 https://exploit-db.com/exploits/46682 · Exploit
• https://oracle.com/security-alerts/cpuapr2022.html · Patch
• https://oracle.com/security-alerts/cpujan2021.html · Patch
• https://oracle.com/security-alerts/cpuApr2021.html · Patch
• https://oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html · Patch
• https://oracle.com/security-alerts/cpujan2020.html · Patch
• https://osv.dev/vulnerability/GHSA-h9gj-rqrw-x4fq · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04406 · Security Note
• https://ubuntu.com/security/CVE-2019-0227 · Vendor Advisory
• https://oracle.com/security-alerts/cpuoct2021.html · Patch
• https://oracle.com/security-alerts/cpuapr2020.html · Patch
• https://cve.org/CVERecord?id=CVE-2019-0227 · Security Note
• https://oracle.com/security-alerts/cpujul2020.html · Patch