NetSight
IP …
high7.5Public exploit code

CVE-2019-0227

A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.

Affected products

VendorProductAffected versions
ApacheAxis
Version 1.4
OracleAgile Engineering Data Management
Version 6.2.1.0
OracleAgile Product Lifecycle Management
Version 9.3.3
OracleApplication Testing Suite
Versions 13.2.0.1, 13.3.0.1
OracleBig Data Discovery
Version 1.6
OracleCommunications Asap Cartridges
Versions 7.2, 7.3
OracleCommunications Design Studio
Versions 7.3.4.3.0, 7.3.5.5.0, 7.4.0.4.0, 7.4.1.1.0
OracleCommunications Element Manager
Versions 8.0.0, 8.1.0, 8.1.1, 8.2.0
OracleCommunications Network Integrity
Versions 7.3.5, 7.3.6
OracleCommunications Order And Service Management
Versions 7.3.0.0.0, 7.4
OracleCommunications Session Report Manager
Versions 8.0.0, 8.1.0, 8.1.1, 8.2.0
OracleCommunications Session Route Manager
Versions 8.0.0, 8.1.0, 8.1.1, 8.2.0

Weakness classification

CWE-918

References