{"id":"CVE-2018-8032","aliases":["CLSA-2026-1771459786","DEBIAN-CVE-2018-8032","DLA-2821-1","EUVD-2018-0560","GHSA-96jq-75wh-2658","MGASA-2018-0431","SUSE-SU-2018:3118-1","SUSE-SU-2018:3119-1","SUSE-SU-2018:3121-1","UBUNTU-CVE-2018-8032","openSUSE-SU-2024:10646-1"],"status":"published","title":"Moderate severity vulnerability that affects apache axis","description":"Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.10554,"percentile":0.95806,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-79"],"published":"2018-08-02T13:00:00Z","modified":"2026-10-30T19:45:15Z","exploits":[{"source":"pocgithub","id":"cairuojin/CVE-2018-8032","title":"cairuojin/CVE-2018-8032","date":"2020-03-30","url":"https://github.com/cairuojin/CVE-2018-8032"}],"fixes":[{"ecosystem":"Debian:12","package":"axis","fixed_in":["1.4-28"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"axis","fixed_in":["1.4-28"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"axis","fixed_in":["1.4-28"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"axis","fixed_in":["1.4-25+deb9u1"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"axis","fixed_in":["1.4-32.1.mga6"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"axis","fixed_in":["1.4-290.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"axis","fixed_in":["1.4-290.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"axis","fixed_in":["1.4-236.236.44.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"axis","fixed_in":["1.4-236.236.44.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"axis","fixed_in":["1.4-5.3.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.axis:axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"axis:axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.4"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.axis:axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4"},{"fixed":"1.4-tuxcare.1"}]}],"versions":["1.4"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-28"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-28"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-28"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-25+deb9u1"}]}],"versions":["1.4-25"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.axis:axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.4"}]}],"versions":["1.4"]},{"source":"osv","ecosystem":"Maven","package":"axis:axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.4"}]}],"versions":["1.0","1.1","1.1-beta","1.2","1.2-RC1","1.2-RC2","1.2-RC3","1.2-alpha-1","1.2-beta-2","1.2-beta-3","1.2.1","1.3","1.4"]},{"source":"osv","ecosystem":"Mageia:6","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-32.1.mga6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-290.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-290.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-236.236.44.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-236.236.44.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-5.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-22","1.4-23","1.4-24","1.4-24ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-25","1.4-25ubuntu0.1~esm1"]}],"products":[{"vendor":"apache","product":"axis"},{"vendor":"apache software foundation","product":"apache axis"},{"vendor":"debian","product":"debian_linux"},{"vendor":"oracle","product":"agile_engineering_data_management"},{"vendor":"oracle","product":"agile_product_lifecycle_management"},{"vendor":"oracle","product":"application_testing_suite"},{"vendor":"oracle","product":"big_data_discovery"},{"vendor":"oracle","product":"communications_asap_cartridges"},{"vendor":"oracle","product":"communications_design_studio"},{"vendor":"oracle","product":"communications_element_manager"},{"vendor":"oracle","product":"communications_network_integrity"},{"vendor":"oracle","product":"communications_order_and_service_management"},{"vendor":"oracle","product":"communications_session_report_manager"},{"vendor":"oracle","product":"communications_session_route_manager"},{"vendor":"oracle","product":"endeca_information_discovery_studio"},{"vendor":"oracle","product":"enterprise_manager_base_platform"},{"vendor":"oracle","product":"enterprise_manager_for_fusion_middleware"},{"vendor":"oracle","product":"financial_services_analytical_applications_infrastructure"},{"vendor":"oracle","product":"financial_services_compliance_regulatory_reporting"},{"vendor":"oracle","product":"financial_services_funds_transfer_pricing"},{"vendor":"oracle","product":"flexcube_core_banking"},{"vendor":"oracle","product":"flexcube_private_banking"},{"vendor":"oracle","product":"hospitality_guest_access"},{"vendor":"oracle","product":"instantis_enterprisetrack"},{"vendor":"oracle","product":"internet_directory"},{"vendor":"oracle","product":"knowledge"},{"vendor":"oracle","product":"peoplesoft_enterprise_human_capital_management_human_resources"},{"vendor":"oracle","product":"peoplesoft_enterprise_peopletools"},{"vendor":"oracle","product":"policy_automation_connector_for_siebel"},{"vendor":"oracle","product":"primavera_gateway"},{"vendor":"oracle","product":"primavera_unifier"},{"vendor":"oracle","product":"rapid_planning"},{"vendor":"oracle","product":"real-time_decision_server"},{"vendor":"oracle","product":"retail_order_broker"},{"vendor":"oracle","product":"retail_xstore_point_of_service"},{"vendor":"oracle","product":"secure_global_desktop"},{"vendor":"oracle","product":"siebel_ui_framework"},{"vendor":"oracle","product":"tuxedo"},{"vendor":"oracle","product":"webcenter_portal"}],"references":[{"url":"http://mail-archives.apache.org/mod_mbox/axis-java-dev/201807.mbox/%3CJIRA.13170716.1531060536000.93536.1531060560060%40Atlassian.JIRA%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/d06ed5e4eeb77d00e8d594ec01ee8ee1cba173a01ac4b18f1579d041%40%3Cjava-dev.axis.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/3b89bc9e9d055db7eba8835ff6501f3f5db99d2a0928ec0be9b1d17b%40%3Cjava-dev.axis.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://issues.apache.org/jira/browse/AXIS-2924","tags":["x_transferred","Issue Tracking","Patch","Vendor Advisory","fix","web","report"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/11/msg00015.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240621-0006/","tags":["x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-8032","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-96jq-75wh-2658","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/3b89bc9e9d055db7eba8835ff6501f3f5db99d2a0928ec0be9b1d17b@%3Cjava-dev.axis.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/d06ed5e4eeb77d00e8d594ec01ee8ee1cba173a01ac4b18f1579d041@%3Cjava-dev.axis.apache.org%3E","tags":["web"]},{"url":"http://mail-archives.apache.org/mod_mbox/axis-java-dev/201807.mbox/%3CJIRA.13170716.1531060536000.93536.1531060560060@Atlassian.JIRA%3E","tags":["web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20240621-0006","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-8032","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0431.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23502","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/Q5PSL3445FAECTG4YYE7GBG6QIR75LAK/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183118-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1103658","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8032","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183119-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183121-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-8032","tags":["report"]},{"url":"https://svn.apache.org/r1831943","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-8032","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3596","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-8032","description":"Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.","status":"published","published":"2018-08-02T13:00:00Z","modified":"2024-09-16T16:29:01.816Z","updated_at":"2026-11-02T14:35:04.172099Z"}],"euvd":[{"id":"EUVD-2018-0560","description":"Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.","status":"published","published":"2018-08-02T13:00:00Z","modified":"2024-09-16T16:29:01Z","updated_at":"2026-11-03T00:55:51.136895Z"}],"ghsa":[{"id":"GHSA-96jq-75wh-2658","title":"Moderate severity vulnerability that affects apache axis","description":"Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.","status":"published","published":"2018-10-16T20:51:15Z","modified":"2024-06-21T22:05:52Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:54.624184Z"}],"nvd":[{"id":"CVE-2018-8032","description":"Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.","status":"published","published":"2018-08-02T13:29:00.363Z","modified":"2026-06-17T02:04:07.943Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:04:35.310988Z"}],"osv":[{"id":"CVE-2018-8032","description":"Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.","status":"published","published":"2018-08-02T13:29:00.363Z","modified":"2026-04-16T06:15:48.365239316Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:09.74357Z"},{"id":"DEBIAN-CVE-2018-8032","description":"Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.","status":"published","published":"2018-08-02T13:29:00.363Z","modified":"2026-10-23T18:03:09.471937903Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"GHSA-96jq-75wh-2658","title":"Moderate severity vulnerability that affects apache axis","description":"Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.","status":"published","published":"2018-10-16T20:51:15Z","modified":"2024-06-25T02:34:38.958612Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:43.123867Z"},{"id":"UBUNTU-CVE-2018-8032","description":"Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.","status":"published","published":"2018-08-02T13:29:00Z","modified":"2025-09-08T16:44:48Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:18.772093Z"},{"id":"CLSA-2026-1771459786","title":"TuxCare security update for org.apache.axis:axis (3 CVEs)","description":"TuxCare rebuilt org.apache.axis:axis to address 3 CVEs. Fixed in 1.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-10-30T19:45:15.801358149Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"DLA-2821-1","title":"axis - security update","status":"published","published":"2021-11-17T00:00:00Z","modified":"2026-03-09T01:21:38.100747Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"MGASA-2018-0431","title":"Updated axis packages fix security vulnerability","description":"Updated axis packages fix security vulnerability:\n\nApache Axis 1.x up to and including 1.4 is vulnerable to a cross-site\nscripting (XSS) attack in the default servlet/services (CVE-2018-8032).\n","status":"published","published":"2018-11-03T11:55:18Z","modified":"2026-04-16T06:24:52.306669359Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2024:10646-1","title":"axis-1.4-302.6 on GA media","description":"These are all security issues fixed in the axis-1.4-302.6 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:24:56.528316Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2018:3118-1","title":"Security update for axis","description":"This update for axis fixes the following security issue:\n\n- CVE-2018-8032: Prevent cross-site scripting (XSS) attack in the default\n  servlet/services (bsc#1103658).\n","status":"published","published":"2018-10-12T08:58:17Z","modified":"2026-02-04T02:43:47.35163Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:3119-1","title":"Security update for axis","description":"This update for axis fixes the following security issue:\n\n- CVE-2018-8032: Prevent cross-site scripting (XSS) attack in the default\n  servlet/services (bsc#1103658).\n","status":"published","published":"2018-10-12T09:43:37Z","modified":"2026-02-04T02:27:49.157655Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:3121-1","title":"Security update for axis","description":"This update for axis fixes the following security issue:\n\n- CVE-2018-8032: Prevent cross-site scripting (XSS) attack in the default\n  servlet/services (bsc#1103658).\n","status":"published","published":"2018-10-12T09:12:44Z","modified":"2026-02-04T02:29:53.882543Z","updated_at":"2026-11-02T15:53:45.378228Z"}]}}