Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-0227

A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.

Published

2019-05-01T21:29:00.643

Last Modified

2025-05-08T18:13:51.353

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

CVSSv2 Vector

AV:A/AC:M/Au:N/C:P/I:P/A:P

  • Access Vector: ADJACENT_NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

5.5

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-918
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application apache axis 1.4 Yes
Application oracle agile_engineering_data_management 6.2.1.0 Yes
Application oracle agile_product_lifecycle_management 9.3.3 Yes
Application oracle application_testing_suite 13.2.0.1 Yes
Application oracle application_testing_suite 13.3.0.1 Yes
Application oracle big_data_discovery 1.6 Yes
Application oracle communications_asap_cartridges 7.2 Yes
Application oracle communications_asap_cartridges 7.3 Yes
Application oracle communications_design_studio 7.3.4.3.0 Yes
Application oracle communications_design_studio 7.3.5.5.0 Yes
Application oracle communications_design_studio 7.4.0.4.0 Yes
Application oracle communications_design_studio 7.4.1.1.0 Yes
Application oracle communications_element_manager 8.0.0 Yes
Application oracle communications_element_manager 8.1.0 Yes
Application oracle communications_element_manager 8.1.1 Yes
Application oracle communications_element_manager 8.2.0 Yes
Application oracle communications_network_integrity 7.3.5 Yes
Application oracle communications_network_integrity 7.3.6 Yes
Application oracle communications_order_and_service_management 7.3.0.0.0 Yes
Application oracle communications_order_and_service_management 7.4 Yes
Application oracle communications_session_report_manager 8.0.0 Yes
Application oracle communications_session_report_manager 8.1.0 Yes
Application oracle communications_session_report_manager 8.1.1 Yes
Application oracle communications_session_report_manager 8.2.0 Yes
Application oracle communications_session_route_manager 8.0.0 Yes
Application oracle communications_session_route_manager 8.1.0 Yes
Application oracle communications_session_route_manager 8.1.1 Yes
Application oracle communications_session_route_manager 8.2.0 Yes
Application oracle endeca_information_discovery_studio 3.2.0 Yes
Application oracle enterprise_manager_base_platform 12.1.0.5 Yes
Application oracle enterprise_manager_base_platform 13.3.0.0 Yes
Application oracle enterprise_manager_for_fusion_middleware 12.1.0.5 Yes
Application oracle financial_services_analytical_applications_infrastructure ≤ 7.3.5 Yes
Application oracle financial_services_analytical_applications_infrastructure ≤ 8.0.8 Yes
Application oracle financial_services_compliance_regulatory_reporting ≤ 8.0.8 Yes
Application oracle financial_services_funds_transfer_pricing ≤ 8.0.7 Yes
Application oracle flexcube_core_banking 11.7.0 Yes
Application oracle flexcube_core_banking 11.8.0 Yes
Application oracle flexcube_core_banking 11.9.0 Yes
Application oracle flexcube_core_banking 11.10.0 Yes
Application oracle flexcube_private_banking 12.0.0 Yes
Application oracle flexcube_private_banking 12.1.0 Yes
Application oracle hospitality_guest_access 4.2.0 Yes
Application oracle hospitality_guest_access 4.2.1 Yes
Application oracle instantis_enterprisetrack 17.1 Yes
Application oracle instantis_enterprisetrack 17.2 Yes
Application oracle instantis_enterprisetrack 17.3 Yes
Application oracle internet_directory 12.2.1.3.0 Yes
Application oracle internet_directory 12.2.1.4.0 Yes
Application oracle knowledge ≤ 8.6.3 Yes
Application oracle peoplesoft_enterprise_human_capital_management_human_resources 7.3.5 Yes
Application oracle peoplesoft_enterprise_human_capital_management_human_resources 7.3.6 Yes
Application oracle peoplesoft_enterprise_human_capital_management_human_resources 9.2 Yes
Application oracle peoplesoft_enterprise_peopletools 8.56 Yes
Application oracle peoplesoft_enterprise_peopletools 8.57 Yes
Application oracle peoplesoft_enterprise_peopletools 8.58 Yes
Application oracle policy_automation_connector_for_siebel 10.4.6 Yes
Application oracle primavera_gateway 16.2.11 Yes
Application oracle primavera_gateway 17.12.6 Yes
Application oracle primavera_unifier ≤ 17.12 Yes
Application oracle primavera_unifier 16.1 Yes
Application oracle primavera_unifier 16.2 Yes
Application oracle primavera_unifier 18.8 Yes
Application oracle primavera_unifier 19.12 Yes
Application oracle rapid_planning 12.1 Yes
Application oracle rapid_planning 12.2 Yes
Application oracle real-time_decision_server 3.2.1.0 Yes
Application oracle retail_order_broker 15.0 Yes
Application oracle retail_order_broker 16.0 Yes
Application oracle retail_order_broker 18.0 Yes
Application oracle retail_xstore_point_of_service 7.1 Yes
Application oracle secure_global_desktop 5.4 Yes
Application oracle secure_global_desktop 5.5 Yes
Application oracle siebel_ui_framework ≤ 21.0 Yes
Application oracle tuxedo 12.1.1.0.0 Yes
Application oracle tuxedo 12.1.3 Yes
Application oracle webcenter_portal 12.2.1.3.0 Yes
References