7.5

CVE-2019-0227

Exploit
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Axis Version 1.4
Oracle ≫ Application Testing Suite Version 13.2.0.1
Oracle ≫ Application Testing Suite Version 13.3.0.1
Oracle ≫ Big Data Discovery Version 1.6
Oracle ≫ Communications Design Studio Version 7.3.4.3.0
Oracle ≫ Communications Design Studio Version 7.3.5.5.0
Oracle ≫ Communications Design Studio Version 7.4.0.4.0
Oracle ≫ Communications Design Studio Version 7.4.1.1.0
Oracle ≫ Financial Services Funds Transfer Pricing Version >= 8.0.2 <= 8.0.7
Oracle ≫ Flexcube Core Banking Version 11.7.0
Oracle ≫ Flexcube Core Banking Version 11.8.0
Oracle ≫ Flexcube Core Banking Version 11.9.0
Oracle ≫ Flexcube Core Banking Version 11.10.0
Oracle ≫ Flexcube Private Banking Version 12.0.0
Oracle ≫ Flexcube Private Banking Version 12.1.0
Oracle ≫ Hospitality Guest Access Version 4.2.0
Oracle ≫ Hospitality Guest Access Version 4.2.1
Oracle ≫ Internet Directory Version 12.2.1.3.0
Oracle ≫ Internet Directory Version 12.2.1.4.0
Oracle ≫ Knowledge Version >= 8.6.0 <= 8.6.3
Oracle ≫ Primavera Gateway Version 16.2.11
Oracle ≫ Primavera Gateway Version 17.12.6
Oracle ≫ Primavera Unifier Version >= 17.7 <= 17.12
Oracle ≫ Primavera Unifier Version 16.1
Oracle ≫ Primavera Unifier Version 16.2
Oracle ≫ Primavera Unifier Version 18.8
Oracle ≫ Primavera Unifier Version 19.12
Oracle ≫ Rapid Planning Version 12.1
Oracle ≫ Rapid Planning Version 12.2
Oracle ≫ Real-time Decision Server Version 3.2.1.0
Oracle ≫ Retail Order Broker Version 15.0
Oracle ≫ Retail Order Broker Version 16.0
Oracle ≫ Retail Order Broker Version 18.0
Oracle ≫ Secure Global Desktop Version 5.4
Oracle ≫ Secure Global Desktop Version 5.5
Oracle ≫ Siebel Ui Framework Version <= 21.0
Oracle ≫ Tuxedo Version 12.1.1.0.0
Oracle ≫ Tuxedo Version 12.1.3
Oracle ≫ Webcenter Portal Version 12.2.1.3.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 91.94% 0.998
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 1.6 5.9
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 5.4 5.5 6.4
AV:A/AC:M/Au:N/C:P/I:P/A:P
CWE-918 Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

https://www.oracle.com/security-alerts/cpujan2020.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html
Patch
Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
Patch
Third Party Advisory
https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E
https://www.oracle.com/security-alerts/cpujul2022.html
https://security.netapp.com/advisory/ntap-20240621-0006/
https://lists.apache.org/thread.html/r3a5baf5d76f1f2181be7f54da3deab70d7a38b5660b387583d05a8cd%40%3Cjava-user.axis.apache.org%3E
https://rhinosecuritylabs.com/application-security/cve-2019-0227-expired-domain-rce-apache-axis/
Third Party Advisory
Exploit