axis-1.2.jar: 4 vulnerabilities (highest severity is: 9.8)

[mend-bolt-for-github]

Vulnerable Library - axis-1.2.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /pom.xml

Found in HEAD commit: 8e77b396d668c29101fea052f4b32fd3ad16341f

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (axis version)	Remediation Possible**
CVE-2023-40743	Critical	9.8	axis-1.2.jar	Direct	N/A	❌
CVE-2018-8032	Medium	6.1	axis-1.2.jar	Direct	libaxis-java - 1.4-28,1.4-28,1.4-28,1.4-25+deb9u1;libaxis-java-doc - 1.4-28,1.4-28,1.4-25+deb9u1,1.4-28;libaxis-java-gcj - 1.4-28,1.4-25+deb9u1,1.4-28,1.4-28	❌
CVE-2014-3596	Medium	4.8	axis-1.2.jar	Direct	axis:axis - 1.3-atlassian-1	❌
CVE-2012-5784	Medium	4.8	axis-1.2.jar	Direct	axis-manual - 1.2.1-7.3;axis - 1.2.1-7.3,1.2.1-7.3;axis-javadoc - 1.2.1-7.3	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-40743

Vulnerable Library - axis-1.2.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /pom.xml

Dependency Hierarchy:

• ❌ axis-1.2.jar (Vulnerable Library)

Found in HEAD commit: 8e77b396d668c29101fea052f4b32fd3ad16341f

Found in base branch: master

Vulnerability Details

** UNSUPPORTED WHEN ASSIGNED ** When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through "ServiceFactory.getService" allows potentially dangerous lookup mechanisms such as LDAP. When passing untrusted input to this API method, this could expose the application to DoS, SSRF and even attacks leading to RCE.

As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. As a workaround, you may review your code to verify no untrusted or unsanitized input is passed to "ServiceFactory.getService", or by applying the patch from apache/axis-axis1-java@7e66753 . The Apache Axis project does not expect to create an Axis 1.x release fixing this problem, though contributors that would like to work towards this are welcome.

Publish Date: 2023-09-05

URL: CVE-2023-40743

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2018-8032

Vulnerable Library - axis-1.2.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /pom.xml

Dependency Hierarchy:

• ❌ axis-1.2.jar (Vulnerable Library)

Found in HEAD commit: 8e77b396d668c29101fea052f4b32fd3ad16341f

Found in base branch: master

Vulnerability Details

Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.

Publish Date: 2018-08-02

URL: CVE-2018-8032

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-8032

Release Date: 2018-08-02

Fix Resolution: libaxis-java - 1.4-28,1.4-28,1.4-28,1.4-25+deb9u1;libaxis-java-doc - 1.4-28,1.4-28,1.4-25+deb9u1,1.4-28;libaxis-java-gcj - 1.4-28,1.4-25+deb9u1,1.4-28,1.4-28

Step up your Open Source Security Game with Mend here

CVE-2014-3596

Vulnerable Library - axis-1.2.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /pom.xml

Dependency Hierarchy:

• ❌ axis-1.2.jar (Vulnerable Library)

Found in HEAD commit: 8e77b396d668c29101fea052f4b32fd3ad16341f

Found in base branch: master

Vulnerability Details

The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.

Publish Date: 2014-08-27

URL: CVE-2014-3596

CVSS 3 Score Details (4.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2014-3596

Release Date: 2014-08-27

Fix Resolution: axis:axis - 1.3-atlassian-1

Step up your Open Source Security Game with Mend here

CVE-2012-5784

Vulnerable Library - axis-1.2.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /pom.xml

Dependency Hierarchy:

• ❌ axis-1.2.jar (Vulnerable Library)

Found in HEAD commit: 8e77b396d668c29101fea052f4b32fd3ad16341f

Found in base branch: master

Vulnerability Details

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Publish Date: 2012-11-04

URL: CVE-2012-5784

CVSS 3 Score Details (4.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2012-5784

Release Date: 2012-11-04

Fix Resolution: axis-manual - 1.2.1-7.3;axis - 1.2.1-7.3,1.2.1-7.3;axis-javadoc - 1.2.1-7.3

Step up your Open Source Security Game with Mend here