CVE Feed

    Dashboard / CVE / CVE-2019-0227

    CVE-2019-0227

    A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.

    Published:Apr 9, 2019
    Last Modified:May 8, 2025
    EPS:May 1, 2019
    EPSS Score:0.90738
    CVSS Score:7.5

    Affected Products

    Vendor
    Apache
    Product
    Axis
    Vendor
    Oracle
    Product
    Agile Engineering Data Management
    Vendor
    Oracle
    Product
    Agile Product Lifecycle Management
    Vendor
    Oracle
    Product
    Application Testing Suite
    Vendor
    Oracle
    Product
    Big Data Discovery
    Vendor
    Oracle
    Product
    Communications Asap Cartridges
    Vendor
    Oracle
    Product
    Communications Design Studio
    Vendor
    Oracle
    Product
    Communications Element Manager
    Vendor
    Oracle
    Product
    Communications Network Integrity
    Vendor
    Oracle
    Product
    Communications Order And Service Management
    Vendor
    Oracle
    Product
    Communications Session Report Manager
    Vendor
    Oracle
    Product
    Communications Session Route Manager
    Vendor
    Oracle
    Product
    Endeca Information Discovery Studio
    Vendor
    Oracle
    Product
    Enterprise Manager Base Platform
    Vendor
    Oracle
    Product
    Enterprise Manager For Fusion Middleware
    Vendor
    Oracle
    Product
    Financial Services Analytical Applications Infrastructure
    Vendor
    Oracle
    Product
    Financial Services Compliance Regulatory Reporting
    Vendor
    Oracle
    Product
    Financial Services Funds Transfer Pricing
    Vendor
    Oracle
    Product
    Flexcube Core Banking
    Vendor
    Oracle
    Product
    Flexcube Private Banking
    Vendor
    Oracle
    Product
    Hospitality Guest Access
    Vendor
    Oracle
    Product
    Instantis Enterprisetrack
    Vendor
    Oracle
    Product
    Internet Directory
    Vendor
    Oracle
    Product
    Knowledge
    Vendor
    Oracle
    Product
    Peoplesoft Enterprise Human Capital Management Human Resources
    Vendor
    Oracle
    Product
    Peoplesoft Enterprise Peopletools
    Vendor
    Oracle
    Product
    Policy Automation Connector For Siebel
    Vendor
    Oracle
    Product
    Primavera Gateway
    Vendor
    Oracle
    Product
    Primavera Unifier
    Vendor
    Oracle
    Product
    Rapid Planning
    Vendor
    Oracle
    Product
    Real-time Decision Server
    Vendor
    Oracle
    Product
    Retail Order Broker
    Vendor
    Oracle
    Product
    Retail Xstore Point Of Service
    Vendor
    Oracle
    Product
    Secure Global Desktop
    Vendor
    Oracle
    Product
    Siebel Ui Framework
    Vendor
    Oracle
    Product
    Tuxedo
    Vendor
    Oracle
    Product
    Webcenter Portal

    Exploits

    https://rhinosecuritylabs.com/application-security/cve-2019-0227-expired-domain-rce-apache-axis/https://rhinosecuritylabs.com/application-security/cve-2019-0227-expired-domain-rce-apache-axis/https://www.exploit-db.com/exploits/46682https://github.com/1475210817/Axis1.4-CVE-2019-0227https://github.com/ianxtianxt/cve-2019-0227

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-664 Server Side Request Forgery

    Related CVEs

    CVE-2023-51441 (CVSS 7.2) — ** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Axis allowed users with acce…
    CVE-2023-40743 (CVSS 9.8) — ** UNSUPPORTED WHEN ASSIGNED ** When integrating Apache Axis 1.x in an application, it may not have been obvio…
    CVE-2018-8032 (CVSS 6.1) — Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default se…
    CVE-2014-3596 (CVSS 5.8) — The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a …
    CVE-2012-5784 (CVSS 5.8) — Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information…
    CVE-2007-2353 (CVSS 5) — Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file…

    References

    https://lists.apache.org/thread.html/r3a5baf5d76f1f2181be7f54da3deab70d7a38b5660b387583d05a8cd%40%3Cjava-user.axis.apache.org%3E
    https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E
    https://rhinosecuritylabs.com/application-security/cve-2019-0227-expired-domain-rce-apache-axis/
    https://security.netapp.com/advisory/ntap-20240621-0006/
    https://www.oracle.com/security-alerts/cpuApr2021.html
    https://www.oracle.com/security-alerts/cpuapr2020.html
    https://www.oracle.com/security-alerts/cpuapr2022.html
    https://www.oracle.com/security-alerts/cpujan2020.html
    https://www.oracle.com/security-alerts/cpujan2021.html
    https://www.oracle.com/security-alerts/cpujul2020.html
    https://www.oracle.com/security-alerts/cpujul2022.html
    https://www.oracle.com/security-alerts/cpuoct2021.html
    https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
    https://lists.apache.org/thread.html/r3a5baf5d76f1f2181be7f54da3deab70d7a38b5660b387583d05a8cd%40%3Cjava-user.axis.apache.org%3E
    https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E
    https://rhinosecuritylabs.com/application-security/cve-2019-0227-expired-domain-rce-apache-axis/
    https://security.netapp.com/advisory/ntap-20240621-0006/
    https://www.oracle.com/security-alerts/cpuApr2021.html
    https://www.oracle.com/security-alerts/cpuapr2020.html
    https://www.oracle.com/security-alerts/cpuapr2022.html
    https://www.oracle.com/security-alerts/cpujan2020.html
    https://www.oracle.com/security-alerts/cpujan2021.html
    https://www.oracle.com/security-alerts/cpujul2020.html
    https://www.oracle.com/security-alerts/cpujul2022.html
    https://www.oracle.com/security-alerts/cpuoct2021.html
    https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High