Improper Input Validation

🗓️ 04 Apr 2024 06:39:23Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 29 Views

Improper Input Validation in Apache Axis `getService` method can lead to Denial of Service, Server Side Request Forgery, or Remote Code Execution attacks

Reporter	Title	Published	Views	Family All 38
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Axis, Apache Shiro and SnakeYAML affect IBM WebSphere Service Registry and Repository	5 Mar 202416:54	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities have been identified with the DS8900F Hardware Management Console (HMC)	6 Apr 202400:29	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is vulnerable to denial of service attack due to Apache Axis (CVE-2023-40743)	31 Jan 202409:00	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Axis1 CVE-2023-40743 security vulnerability in FileNet Content Manager, Process Engine Process Orchestration	20 Mar 202516:49	–	ibm
Amazon	Important: axis	3 Oct 202300:00	–	amazon
Tenable Nessus	Amazon Linux AMI : axis (ALAS-2023-1840)	6 Oct 202300:00	–	nessus
Tenable Nessus	Debian dla-3622 : libaxis-java - security update	23 Oct 202300:00	–	nessus
Tenable Nessus	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : Axis vulnerability (USN-6470-1)	2 Nov 202300:00	–	nessus
AstraLinux	Astra Linux - уязвимость в axis	20 May 202605:53	–	astralinux
Circl	CVE-2023-40743	5 Sep 202318:17	–	circl

Vulners

Node

apache axisRange1.2-alpha-1–1.4java

apache axisMatch1.4java

Source	Link
github	www.github.com/apache/axis-axis1-java/commit/7e66753427466590d6def0125e448d2791723210
lists	www.lists.apache.org/thread/gs0qgk2mgss7zfhzdd6ftfjvm4kp7v82
github	www.github.com/advisories/GHSA-rmqp-9w4c-gc7w
lists	www.lists.debian.org/debian-lts-announce/2023/10/msg00025.html

13 Feb 2025 19:35Current

7.2High risk

Vulners AI Score7.2

CVSS 3.19.8

EPSS0.00707

SSVC