Skip to content
Fencer Vulns
critical 9.8

CVE-2023-40743 json

Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getService

published 2023-09-05 3 y ago modified 2026-06-17 4 mo ago also GHSA-rmqp-9w4c-gc7w , EUVD-2023-2587

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
3.3%
EPSS 3.3% chance of exploitation in 30 days, percentile 88%
public exploits
0
none known

Summary

** UNSUPPORTED WHEN ASSIGNED ** When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through "ServiceFactory.getService" allows potentially dangerous lookup mechanisms such as LDAP. When passing untrusted input to this API method, this could expose the application to DoS, SSRF and even attacks leading to RCE.

As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. As a workaround, you may review your code to verify no untrusted or unsanitized input is passed to "ServiceFactory.getService", or by applying the patch from https://github.com/apache/axis-axis1-java/commit/7e66753427466590d6def0125e448d2791723210 . The Apache Axis project does not expect to create an Axis 1.x release fixing this problem, though contributors that would like to work towards this are welcome.

Patch / fix

  • apache axis 2023-08-01
  • axis Debian 12 1.4-28+deb12u1
  • axis Debian 14, Debian 13 1.4-29

debian advisories DEBIAN-CVE-2023-40743

  • axis Ubuntu 20.04 LTS 1.4-28+deb10u1build0.20.04.1
  • axis Ubuntu 22.04 LTS 1.4-28+deb10u1build0.22.04.1
  • axis Ubuntu Pro 16.04 LTS 1.4-24ubuntu0.1~esm1
  • axis Ubuntu Pro 18.04 LTS 1.4-25ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2023-40743

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
2 y ago

Exploit prediction

3.28% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.apache.axis:axis
<=1.4
 no fix listed
maven axis:axis
<=1.4
 no fix listed

Affected products

  • Apache Software Foundation Apache Axis
  • apache axis

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-75 Failure to Sanitize Special Elements into a Different Plane

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.