sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2019-0227 Server Side Request Forgery in Apache Axis

High 7.5 Published Updated
Exploited in the wild
Not known
Fix
Available

What is CVE-2019-0227?

CVE-2019-0227 is a high-severity vulnerability in Oracle Agile Product Lifecycle Management, published on 1 May 2019.

Official description

A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.

Weakness: CWE-918

Which versions are affected by CVE-2019-0227?

4 open source packages ship an affected version, including axis:axis and org.apache.axis:axis. It affects 37 products.

PackageAffectedFixed in
axis:axis MavenAll versions to 1.4None
axis:axis MavenAll versions to 1.4None
org.apache.axis:axis MavenAll versions to 1.4None
org.apache.axis:axis MavenAll versions to 1.4None

Products include Apache Axis, Oracle Agile Engineering Data Management, Oracle Agile Product Lifecycle Management, Oracle Application Testing Suite, Oracle Big Data Discovery, Oracle Communications Asap Cartridges and 31 more.

How do I fix CVE-2019-0227?

Upgrade to a fixed version.

Is CVE-2019-0227 being exploited?

There is no known exploitation of CVE-2019-0227 in the wild and no public exploit code.

Public exploit code: 1 Exploit-DB entry and 2 proofs of concept on GitHub.

All Oracle Agile Product Lifecycle Management vulnerabilities

Sources

Also known as DEBIAN-CVE-2019-0227, GHSA-h9gj-rqrw-x4fq, UBUNTU-CVE-2019-0227.

Is CVE-2019-0227 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free