Log in Start free

Vulnerability · Published Jan 6, 2024 · Assigned by apache

CVE-2023-51441Apache Axis 1.x (EOL) may allow SSRF when untrusted input is passed to the service admin HTTP API

High 7.2

In plain English

A high-severity server-side request forgery in Apache Axis from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.2High
Exploit odds (30 days)1.2%top 31.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Axis allowed users with access to the admin service to perform possible SSRF This issue affects Apache Axis: through 1.3. As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/685c309febc64aa393b2d64a05f90e7eb9f73e06 applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem, though contributors that would like to work towards this are welcome.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12axisno fix listedDEBIAN-CVE-2023-51441
Debian:13axisno fix listedDEBIAN-CVE-2023-51441
Debian:14axis1.4-30DEBIAN-CVE-2023-51441
Mavenaxis:axisno fix listedGHSA-hr2c-p8rh-238h
Mavenorg.apache.axis:axisno fix listedGHSA-hr2c-p8rh-238h
Ubuntu:22.04:LTSaxisno fix listedUBUNTU-CVE-2023-51441
Ubuntu:24.04:LTSaxisno fix listedUBUNTU-CVE-2023-51441
Ubuntu:25.10axisno fix listedUBUNTU-CVE-2023-51441
Ubuntu:26.04:LTSaxisno fix listedUBUNTU-CVE-2023-51441
Ubuntu:26.10axisno fix listedUBUNTU-CVE-2023-51441

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache Axis 0 – through 1.3

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References