CVE-2023-51441
Assigner: apache
Published: 2024-01-06T11:59:37.769Z
State: PUBLISHED
affected: collectionURL: https://repo.maven.apache.org/maven2
defaultStatus: unaffected
packageName: org.apache.axis:axis-rt-core
product: Apache Axis
vendor: Apache Software Foundation
versions: lessThanOrEqual: 1.3
status: affected
version: 0
versionType: semver
credits: type: finder
value: thiscodecc of MoyunSec Vlab and Bing
descriptions: supportingMedia: base64: no
type: text/html
value: ** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Axis allowed users with access to the admin service to perform possible SSRF<br><p>This issue affects Apache Axis: through 1.3.</p><p>As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from <a target="_blank" rel="nofollow" href="https://github.com/apache/axis-axis1-java/commit/685c309febc64aa393b2d64a05f90e7eb9f73e06">https://github.com/apache/axis-axis1-java/commit/685c309febc64aa393b2d64a05f90e7eb9f73e06</a> applied. The Apache Axis project does not expect to create an Axis 1.x release 
fixing this problem, though contributors that would like to work towards
 this are welcome.
</p>
value: ** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Axis allowed users with access to the admin service to perform possible SSRF
This issue affects Apache Axis: through 1.3.

As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from  https://github.com/apache/axis-axis1-java/commit/685c309febc64aa393b2d64a05f90e7eb9f73e06  applied. The Apache Axis project does not expect to create an Axis 1.x release 
fixing this problem, though contributors that would like to work towards
 this are welcome.


metrics: other: content: text: low
type: Textual description of severity
problemTypes: descriptions: cweId: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
type: CWE
source: discovery: UNKNOWN
title: Apache Axis 1.x (EOL) may allow SSRF when untrusted input is passed to the service admin HTTP API
x_generator: engine: Vulnogram 0.1.0-dev