Skip to content
Fencer Vulns
high 7.2

CVE-2023-51441 json

Apache Axis 1.x (EOL) may allow SSRF when untrusted input is passed to the service admin HTTP API

published 2024-01-06 2 y ago modified 2026-06-17 4 mo ago also GHSA-hr2c-p8rh-238h , EUVD-2024-0370

cvss
7.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 68%
public exploits
0
none known

Summary

** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Axis allowed users with access to the admin service to perform possible SSRF This issue affects Apache Axis: through 1.3.

As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/685c309febc64aa393b2d64a05f90e7eb9f73e06 applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem, though contributors that would like to work towards this are welcome.

Patch / fix

  • axis Debian 14 1.4-30

debian advisories DEBIAN-CVE-2023-51441

  • axis SLE Module for Basesystem 15 SP5, openSUSE Leap 15.5 1.4-150200.13.9.1
  • axis SLES for SAP 12 SP5, SLES 12 SP5 1.4-290.9.1

suse advisories SUSE-SU-2024:0852-1SUSE-SU-2024:0851-1

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

1.21% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.apache.axis:axis
<=1.3
 no fix listed
maven axis:axis
<=1.3
 no fix listed

Affected products

  • Apache Software Foundation Apache Axis

Classification

Weakness
  • CWE-918 Server-Side Request Forgery
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.