CVEvulnerability

CVE-2019-0227

7.5 HIGH Published 2019-05-01 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-05-01
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
5.4 MEDIUM — AV:A/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-918

Description

A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.

Affected configurations

• apache axis 1.4 • oracle agile engineering data management 6.2.1.0 • oracle agile product lifecycle management 9.3.3 • oracle application testing suite 13.2.0.1 • oracle application testing suite 13.3.0.1 • oracle big data discovery 1.6 • oracle communications asap cartridges 7.2 • oracle communications asap cartridges 7.3 • oracle communications design studio 7.3.4.3.0 • oracle communications design studio 7.3.5.5.0 • oracle communications design studio 7.4.0.4.0 • oracle communications design studio 7.4.1.1.0 • oracle communications element manager 8.0.0 • oracle communications element manager 8.1.0 • oracle communications element manager 8.1.1 • oracle communications element manager 8.2.0 • oracle communications network integrity 7.3.5 • oracle communications network integrity 7.3.6 • oracle communications order and service management 7.3.0.0.0 • oracle communications order and service management 7.4 • oracle communications session report manager 8.0.0 • oracle communications session report manager 8.1.0 • oracle communications session report manager 8.1.1 • oracle communications session report manager 8.2.0 • oracle communications session route manager 8.0.0 • oracle communications session route manager 8.1.0 • oracle communications session route manager 8.1.1 • oracle communications session route manager 8.2.0 • oracle endeca information discovery studio 3.2.0 • oracle enterprise manager base platform 12.1.0.5 • oracle enterprise manager base platform 13.3.0.0 • oracle enterprise manager for fusion middleware 12.1.0.5 • oracle financial services analytical applications infrastructure (>= 7.3.3 <= 7.3.5) • oracle financial services analytical applications infrastructure (>= 8.0.0 <= 8.0.8) • oracle financial services compliance regulatory reporting (>= 8.0.6 <= 8.0.8) • oracle financial services funds transfer pricing (>= 8.0.2 <= 8.0.7) • oracle flexcube core banking 11.7.0 • oracle flexcube core banking 11.8.0 • oracle flexcube core banking 11.9.0 • oracle flexcube core banking 11.10.0 • oracle flexcube private banking 12.0.0 • oracle flexcube private banking 12.1.0 • oracle hospitality guest access 4.2.0 • oracle hospitality guest access 4.2.1 • oracle instantis enterprisetrack 17.1 • oracle instantis enterprisetrack 17.2 • oracle instantis enterprisetrack 17.3 • oracle internet directory 12.2.1.3.0 • oracle internet directory 12.2.1.4.0 • oracle knowledge (>= 8.6.0 <= 8.6.3) • oracle peoplesoft enterprise human capital management human resources 7.3.5 • oracle peoplesoft enterprise human capital management human resources 7.3.6 • oracle peoplesoft enterprise human capital management human resources 9.2 • oracle peoplesoft enterprise peopletools 8.56 • oracle peoplesoft enterprise peopletools 8.57 • oracle peoplesoft enterprise peopletools 8.58 • oracle policy automation connector for siebel 10.4.6 • oracle primavera gateway 16.2.11 • oracle primavera gateway 17.12.6 • oracle primavera unifier (>= 17.7 <= 17.12) … and 17 more

Related

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References