Axis
Vendor:
First CVE: Apr 30, 2007 · Active for 19 years
7
Total CVEs
More Total CVEs than 83% of tracked products
1.0
Avg CVEs / Year
Bottom 1%
6.7
Avg CVSS
Higher Avg CVSS than 36% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Axis over time
Volume of CVEsAvg CVSS Base Score
First CVE
Apr 30, 2007
19 years ago
Most Recent CVE
Jan 6, 2024
930 days ago
CVE Severity & Scoring
Axis7 CVEs
57%
29%
14%
All CVEs352,231 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network3 (42.9%)
Unknown3 (42.9%)
Physical0 (0.0%)
Adjacent Network1 (14.3%)
Attack Complexity
Low3 (42.9%)
High1 (14.3%)
Unknown3 (42.9%)
User Interaction
None3 (42.9%)
Unknown3 (42.9%)
Required1 (14.3%)
Privileges Required
Low0 (0.0%)
High1 (14.3%)
None3 (42.9%)
Unknown3 (42.9%)
Top CVEs
Signals from CVEs in this product scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-0227HIGH A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projec | May 1, 2019 | 7.5 | 82 | NO | YES |
CVE-2007-2353MEDIUM Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installation path in the resulting exception messa | Apr 30, 2007 | 5.0 | 35 | NO | YES |
CVE-2023-40743CRITICAL ** UNSUPPORTED WHEN ASSIGNED ** When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through "ServiceFactory.getService" allow | Sep 5, 2023 | 9.8 | 29 | NO | NO |
CVE-2018-8032MEDIUM Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services. | Aug 2, 2018 | 6.1 | 26 | NO | NO |
CVE-2023-51441HIGH ** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Axis allowed users with access to the admin service to perform possible SSRF
This issue affects Ap | Jan 6, 2024 | 7.2 | 22 | NO | NO |
CVE-2012-5784MEDIUM Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and | Nov 4, 2012 | 5.8 | 22 | NO | NO |
CVE-2014-3596MEDIUM The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field | Aug 27, 2014 | 5.8 | 19 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (7 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
2 CVEs
28.6% of CVEs· 90th percentile
Social Chatter
Signals from CVEs in this product scope (7 CVEs).
Media Mentions
Signals from CVEs in this product scope (7 CVEs).
Top CNAs Publishing CVEs For Axis
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 1.4 | 1 | 7.5 | 86.5% | 0 | 1 |
| 1.3 | 2 | 5.8 | 7.4% | 0 | 0 |
| 1.2.1 | 2 | 5.8 | 7.4% | 0 | 0 |
| 1.2 | 2 | 5.8 | 7.4% | 0 | 0 |
| 1.1 | 2 | 5.8 | 7.4% | 0 | 0 |
| 1.0 | 3 | 5.7 | 9.7% | 0 | 1 |