CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-40743 – Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getService
https://notcve.org/view.php?id=CVE-2023-40743
When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through "ServiceFactory.getService" allows potentially dangerous lookup mechanisms such as LDAP. When passing untrusted input to this API method, this could expose the application to DoS, SSRF and even attacks leading to RCE. As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. As a workaround, you may review your code to verify no untrusted or unsanitized input is passed to "ServiceFactory.getService", or by applying the patch from https://github.com/apache/axis-axis1-java/commit/7e66753427466590d6def0125e448d2791723210 . The Apache Axis project does not expect to create an Axis 1.x release fixing this problem, though contributors that would like to work towards this are welcome. Al integrar Apache Axis 1.x en una aplicación, puede que no haya sido obvio que buscar un servicio a través de "ServiceFactory.getService" permita mecanismos de búsqueda potencialmente peligrosos como LDAP . • https://github.com/apache/axis-axis1-java/commit/7e66753427466590d6def0125e448d2791723210 https://lists.apache.org/thread/gs0qgk2mgss7zfhzdd6ftfjvm4kp7v82 https://lists.debian.org/debian-lts-announce/2023/10/msg00025.html • CWE-20: Improper Input Validation CWE-75: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) •
CVSS: 7.5EPSS: 86%CPEs: 77EXPL: 2CVE-2019-0227 – Apache Axis 1.4 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-0227
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue. Una vulnerabilidad de tipo SSRF (Server Side Request Forgery) afectó a la distribución de Apache Axis 1.4 que fue lanzada por última vez en 2006. La seguridad y las confirmaciones de errores continúan en el repositorio de Subversion de Axis 1.x, se anima a los usuarios a construir desde el código fuente. • https://www.exploit-db.com/exploits/46682 https://lists.apache.org/thread.html/r3a5baf5d76f1f2181be7f54da3deab70d7a38b5660b387583d05a8cd%40%3Cjava-user.axis.apache.org%3E https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E https://rhinosecuritylabs.com/application-security/cve-2019-0227-expired-domain-rce-apache-axis https://security.netapp.com/advisory/ntap-20240621-0006 https://www.oracle.com/security-alerts/cpuApr2021.html https://www.oracle.com/security-alerts/cpua • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.1EPSS: 0%CPEs: 76EXPL: 1CVE-2018-8032
https://notcve.org/view.php?id=CVE-2018-8032
Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services. Apache Axis en versiones 1.x hasta la 1.4 (incluida) es vulnerable a un ataque de Cross-Site Scripting (XSS) en el servlet/services por defecto. • https://github.com/cairuojin/CVE-2018-8032 http://mail-archives.apache.org/mod_mbox/axis-java-dev/201807.mbox/%3CJIRA.13170716.1531060536000.93536.1531060560060%40Atlassian.JIRA%3E https://issues.apache.org/jira/browse/AXIS-2924 https://lists.apache.org/thread.html/3b89bc9e9d055db7eba8835ff6501f3f5db99d2a0928ec0be9b1d17b%40%3Cjava-dev.axis.apache.org%3E https://lists.apache.org/thread.html/d06ed5e4eeb77d00e8d594ec01ee8ee1cba173a01ac4b18f1579d041%40%3Cjava-dev.axis.apache.org%3E https://lists.debian.org/debian-lts-announce/2021/11& • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.8EPSS: 0%CPEs: 19EXPL: 0CVE-2014-3596 – axis: SSL hostname verification bypass, incomplete CVE-2012-5784 fix
https://notcve.org/view.php?id=CVE-2014-3596
The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784. La función getCN en Apache Axis 1.4 y versiones anteriores no verifica correctamente que el nombre de host del servidor coincida con un nombre de dominio en el campo Common Name (CN) o subjectAltName del certificado X.509, lo que permite a los atacantes intermedios falsificar servidores SSL mediante un certificado con un asunto que especifica un nombre común en un campo que no es el campo CN. NOTA: este problema existe debido a una solución incompleta para CVE-2012-5784. It was discovered that Axis incorrectly extracted the host name from an X.509 certificate subject's Common Name (CN) field. • http://linux.oracle.com/errata/ELSA-2014-1193.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00007.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00022.html http://rhn.redhat.com/errata/RHSA-2014-1193.html http://secunia.com/advisories/61222 http://www.openwall.com/lists/oss-security/2014/08/20/2 http://www.securityfocus.com/bid/69295 http://www.securitytracker.com/id/1030745 https://exchange.xforce.ibmcloud.com/vulnerabilities/95377 http • CWE-297: Improper Validation of Certificate with Host Mismatch •
CVSS: 5.8EPSS: 0%CPEs: 29EXPL: 1CVE-2012-5784 – axis: missing connection hostname check against X.509 certificate name
https://notcve.org/view.php?id=CVE-2012-5784
Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. Apache Axis v1.4 y versiones anteriores, tal y como se utiliza en los pagos de PayPal Pro, PPayPal Mass Pay, PayPal Transactional Information SOAP, la implementación de Java Message Service en Apache ActiveMQ, y otros productos, no comprueba si el nombre del servidor coincide con un nombre de dominio en el Nombre Común (CN) del sujeto o el campo subjectAltName del certificado X.509, lo que permite falsificar servidores SSL a atacantes "man-in-the-middle" mediante un certificado válido de su elección. Apache Axis did not verify that the server host name matched the domain name in the subject's Common Name (CN) or subjectAltName field in X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL server if they had a certificate that was valid for any domain name. • http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00007.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00022.html http://rhn.redhat.com/errata/RHSA-2013-0269.html http://rhn.redhat.com/errata/RHSA-2013-0683.html http://rhn.redhat.com/errata/RHSA-2014-0037.html http://secunia.com/advisories/51219 http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf http://www.securityfocus.com/bid/56408 https://exchange.xforce.ibmcloud.com/vulnerabilities/79829 ht • CWE-20: Improper Input Validation •