Improper Input Validation Affecting axis:axis package, versions [0,]


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.32% (72nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Improper Input Validation vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-JAVA-AXIS-5898629
  • published13 Sept 2023
  • disclosed5 Sept 2023
  • creditLetian Yuan

Introduced: 5 Sep 2023

CVE-2023-40743  (opens in a new tab)
CWE-20  (opens in a new tab)

How to fix?

There is no fixed version for axis:axis.

Overview

axis:axis is an implementation of the SOAP ("Simple Object Access Protocol") submission to W3C.

Affected versions of this package are vulnerable to Improper Input Validation via the ServiceFactory.getService functionality, which allows potentially dangerous lookup mechanisms. Exploiting this vulnerability is possible when passing untrusted input to this API method and might result in DoS, SSRF and even RCE.

Note

As Axis 1 has been EOL it is recommended to migrate to a different SOAP engine, such as Apache Axis 2/Java. As a workaround, you may review your code to verify no untrusted or unsanitized input is passed to ServiceFactory.getService, or by applying the patch from the commit shared in the references.

CVSS Scores

version 3.1