CVE-2018-8032
Moderate severity vulnerability that affects apache axis
Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.
- Record
CVE-2018-8032- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.
- Record
CVE-2018-8032- Updated
- 2026-11-02
EUVDEUVD-2018-0560 No score
Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.
- Record
EUVD-2018-0560- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-96jq-75wh-2658
Moderate severity vulnerability that affects apache axis
Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.
- Record
GHSA-96jq-75wh-2658- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.
- Record
CVE-2018-8032- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-8032
Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.
- Record
DEBIAN-CVE-2018-8032- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 8 moreShow less
OSVGHSA-96jq-75wh-2658
Moderate severity vulnerability that affects apache axis
Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.
- Record
GHSA-96jq-75wh-2658- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-8032
Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.
- Record
UBUNTU-CVE-2018-8032- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1771459786 No score
TuxCare security update for org.apache.axis:axis (3 CVEs)
TuxCare rebuilt org.apache.axis:axis to address 3 CVEs. Fixed in 1.4-tuxcare.1.
- Record
CLSA-2026-1771459786- Updated
- 2026-11-02
OSVMGASA-2018-0431 No score
Updated axis packages fix security vulnerability
Updated axis packages fix security vulnerability:
Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services (CVE-2018-8032).
- Record
MGASA-2018-0431- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10646-1 No score
axis-1.4-302.6 on GA media
These are all security issues fixed in the axis-1.4-302.6 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10646-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:3118-1 No score
Security update for axis
This update for axis fixes the following security issue:
- CVE-2018-8032: Prevent cross-site scripting (XSS) attack in the default servlet/services (bsc#1103658).
- Record
SUSE-SU-2018:3118-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:3119-1 No score
Security update for axis
This update for axis fixes the following security issue:
- CVE-2018-8032: Prevent cross-site scripting (XSS) attack in the default servlet/services (bsc#1103658).
- Record
SUSE-SU-2018:3119-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:3121-1 No score
Security update for axis
This update for axis fixes the following security issue:
- CVE-2018-8032: Prevent cross-site scripting (XSS) attack in the default servlet/services (bsc#1103658).
- Record
SUSE-SU-2018:3121-1- Updated
- 2026-11-02
Affected products
- apache axis
- apache software foundation axis
- debian linux
- oracle agile engineering data management
- oracle agile product lifecycle management
- oracle application testing suite
- oracle big data discovery
- oracle communications asap cartridges
- oracle communications design studio
- oracle communications element manager
- oracle communications network integrity
- oracle communications order and service management
Show 27 moreShow less
- oracle communications session report manager
- oracle communications session route manager
- oracle endeca information discovery studio
- oracle enterprise manager base platform
- oracle enterprise manager for fusion middleware
- oracle financial services analytical applications infrastructure
- oracle financial services compliance regulatory reporting
- oracle financial services funds transfer pricing
- oracle flexcube core banking
- oracle flexcube private banking
- oracle hospitality guest access
- oracle instantis enterprisetrack
- oracle internet directory
- oracle knowledge
- oracle peoplesoft enterprise human capital management human resources
- oracle peoplesoft enterprise peopletools
- oracle policy automation connector for siebel
- oracle primavera gateway
- oracle primavera unifier
- oracle rapid planning
- oracle real-time decision server
- oracle retail order broker
- oracle retail xstore point of service
- oracle secure global desktop
- oracle siebel ui framework
- oracle tuxedo
- oracle webcenter portal
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.axis:axisMaven |
through 1.4 | None known |
axis:axisMaven |
through 1.4 | None known |
org.apache.axis:axisTuxCare:Maven |
1.4 up to 1.4-tuxcare.1 | 1.4-tuxcare.1 |
axisDebian:12 |
before 1.4-28 | 1.4-28 |
axisDebian:13 |
before 1.4-28 | 1.4-28 |
axisDebian:14 |
before 1.4-28 | 1.4-28 |
axisDebian:9 |
before 1.4-25+deb9u1, plus listed versions 1.4-25 |
1.4-25+deb9u1 |
axis:axisMaven |
through 1.4, plus listed versions 1.01.11.1-beta1.21.2-RC1 Show 7 moreShow less1.2-RC21.2-RC31.2-alpha-11.2-beta-21.2-beta-31.2.11.3 |
None known |
axisMageia:6 |
before 1.4-32.1.mga6 | 1.4-32.1.mga6 |
axisSUSE:Linux Enterprise Server 12 SP3 |
before 1.4-290.3.1 | 1.4-290.3.1 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
axisSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 1.4-290.3.1 | 1.4-290.3.1 |
axisSUSE:Linux Enterprise Server 11 SP4 |
before 1.4-236.236.44.9.1 | 1.4-236.236.44.9.1 |
axisSUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 1.4-236.236.44.9.1 | 1.4-236.236.44.9.1 |
axisSUSE:Linux Enterprise Module for Basesystem 15 |
before 1.4-5.3.1 | 1.4-5.3.1 |
axisUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.4-221.4-231.4-241.4-24ubuntu0.1~esm1 |
None known |
axisUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.4-251.4-25ubuntu0.1~esm1 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | cairuojin/CVE-2018-8032 | 2020-03-30 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-8032 is a medium vulnerability (CVSS 6.1) in Apache Axis, published August 2, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 10.6%, the 95th percentile. Fixed in org.apache.axis:axis 1.4-tuxcare.1.
References
mail-archives.apache.org/mod_mbox/axis-java-dev/201807.mbox/%3CJIRA.13170716.1531060536000.93536.1531060560060%40Atlassian.JIRA%3E
lists.apache.org/thread.html/d06ed5e4eeb77d00e8d594ec01ee8ee1cba173a01ac4b18f1579d041%40%3Cjava-dev.axis.apache.org%3E
oracle.com/security-alerts/cpuapr2020.html
Show 28 moreShow less
issues.apache.org/jira/browse/AXIS-2924
lists.debian.org/debian-lts-announce/2021/11/msg00015.html
security.netapp.com/advisory/ntap-20240621-0006
nvd.nist.gov/vuln/detail/CVE-2018-8032
github.com/advisories/GHSA-96jq-75wh-2658
security-tracker.debian.org/tracker/CVE-2018-8032
advisories.mageia.org/MGASA-2018-0431.html
bugs.mageia.org/show_bug.cgi?id=23502
lists.fedoraproject.org/archives/list/[email protected]/thread/Q5PSL3445FAECTG4YYE7GBG6QIR75LAK
suse.com/support/update/announcement/2018/suse-su-20183118-1
bugzilla.suse.com/1103658
ubuntu.com/security/CVE-2018-8032
svn.apache.org/r1831943
cve.org/CVERecord?id=CVE-2018-8032