{"id":"CVE-2023-51441","aliases":["DEBIAN-CVE-2023-51441","EUVD-2024-0370","GHSA-hr2c-p8rh-238h","SUSE-SU-2024:0851-1","SUSE-SU-2024:0852-1","UBUNTU-CVE-2023-51441","openSUSE-SU-2024:13659-1"],"status":"published","title":"Apache Axis 1.x (EOL) may allow SSRF when untrusted input is passed to the service admin HTTP API","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Axis allowed users with access to the admin service to perform possible SSRF\nThis issue affects Apache Axis: through 1.3.\n\nAs Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from  https://github.com/apache/axis-axis1-java/commit/685c309febc64aa393b2d64a05f90e7eb9f73e06  applied. The Apache Axis project does not expect to create an Axis 1.x release \nfixing this problem, though contributors that would like to work towards\n this are welcome.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01213,"percentile":0.68775,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-918"],"published":"2024-01-06T11:59:37Z","modified":"2026-11-11T02:47:33Z","fixes":[{"ecosystem":"Debian:14","package":"axis","fixed_in":["1.4-30"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"axis","fixed_in":["1.4-290.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"axis","fixed_in":["1.4-290.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"axis","fixed_in":["1.4-150200.13.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"axis","fixed_in":["1.4-150200.13.9.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.axis:axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"axis:axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-28","1.4-28+deb12u1","1.4-29","1.4-30"]},{"source":"osv","ecosystem":"Debian:13","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-29","1.4-30"]},{"source":"osv","ecosystem":"Debian:14","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-30"}]}],"versions":["1.4-29"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.axis:axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.3"}]}]},{"source":"osv","ecosystem":"Maven","package":"axis:axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.3"}]}],"versions":["1.0","1.1","1.1-beta","1.2","1.2-RC1","1.2-RC2","1.2-RC3","1.2-alpha-1","1.2-beta-2","1.2-beta-3","1.2.1","1.3"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-290.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-290.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-150200.13.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-150200.13.9.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-22","1.4-23","1.4-24","1.4-24ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-25","1.4-25ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-28","1.4-28+deb10u1build0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-28","1.4-28+deb10u1build0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-28","1.4-29"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-29"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-29build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"axis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-29","1.4-29build1"]}],"products":[{"vendor":"apache","product":"axis"},{"vendor":"apache software foundation","product":"apache axis"}],"references":[{"url":"https://github.com/apache/axis-axis1-java/commit/685c309febc64aa393b2d64a05f90e7eb9f73e06","tags":["patch","x_transferred","Patch","fix","web","report"]},{"url":"https://lists.apache.org/thread/8nrm5thop8f82pglx4o0jg8wmvy6d9yd","tags":["vendor-advisory","x_transferred","Patch","Third Party Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-51441","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hr2c-p8rh-238h"},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51441.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-51441","tags":["advisory"]},{"url":"https://github.com/apache/axis-axis1-java","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240851-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1218605","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-51441","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240852-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-51441","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2024/01/05/2","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-51441","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-51441","title":"Apache Axis 1.x (EOL) may allow SSRF when untrusted input is passed to the service admin HTTP API","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Axis allowed users with access to the admin service to perform possible SSRF\nThis issue affects Apache Axis: through 1.3.\n\nAs Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from  https://github.com/apache/axis-axis1-java/commit/685c309febc64aa393b2d64a05f90e7eb9f73e06  applied. The Apache Axis project does not expect to create an Axis 1.x release \nfixing this problem, though contributors that would like to work towards\n this are welcome.\n\n","status":"published","published":"2024-01-06T11:59:37.769Z","modified":"2025-06-18T15:50:11.058Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:35:17.48054Z"}],"euvd":[{"id":"EUVD-2024-0370","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Axis allowed users with access to the admin service to perform possible SSRF\nThis issue affects Apache Axis: through 1.3.\n\nAs Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from  https://github.com/apache/axis-axis1-java/commit/685c309febc64aa393b2d64a05f90e7eb9f73e06  applied. The Apache Axis project does not expect to create an Axis 1.x release \nfixing this problem, though contributors that would like to work towards\n this are welcome.\n\n","status":"published","published":"2024-01-06T11:59:37Z","modified":"2025-06-18T15:50:11Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:20.01453Z"}],"ghsa":[{"id":"GHSA-hr2c-p8rh-238h","title":"Apache Axis Improper Input Validation vulnerability","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Axis allowed users with access to the admin service to perform possible SSRF.\nThis issue affects Apache Axis through 1.3.\n\nAs Axis 1 has been EOL, we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/685c309febc64aa393b2d64a05f90e7eb9f73e06 applied. The Apache Axis project does not expect to create an Axis 1.x release \nfixing this problem, though contributors that would like to work towards this are welcome.","status":"published","published":"2024-01-06T12:30:34Z","modified":"2024-03-14T21:57:51Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20","CWE-918"],"updated_at":"2026-11-02T14:37:40.81935Z"}],"nvd":[{"id":"CVE-2023-51441","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Axis allowed users with access to the admin service to perform possible SSRF\nThis issue affects Apache Axis: through 1.3.\n\nAs Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from  https://github.com/apache/axis-axis1-java/commit/685c309febc64aa393b2d64a05f90e7eb9f73e06  applied. The Apache Axis project does not expect to create an Axis 1.x release \nfixing this problem, though contributors that would like to work towards\n this are welcome.\n\n","status":"published","published":"2024-01-06T12:15:42.997Z","modified":"2026-06-17T06:40:57.88Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:08:59.830468Z"}],"osv":[{"id":"CVE-2023-51441","title":"Apache Axis 1.x (EOL) may allow SSRF when untrusted input is passed to the service admin HTTP API","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Axis allowed users with access to the admin service to perform possible SSRF\nThis issue affects Apache Axis: through 1.3.\n\nAs Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from  https://github.com/apache/axis-axis1-java/commit/685c309febc64aa393b2d64a05f90e7eb9f73e06  applied. The Apache Axis project does not expect to create an Axis 1.x release \nfixing this problem, though contributors that would like to work towards\n this are welcome.\n\n","status":"published","published":"2024-01-06T11:59:37.769Z","modified":"2026-11-11T02:47:33.829869894Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-11T03:22:28.447808Z"},{"id":"DEBIAN-CVE-2023-51441","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Axis allowed users with access to the admin service to perform possible SSRF This issue affects Apache Axis: through 1.3.  As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from  https://github.com/apache/axis-axis1-java/commit/685c309febc64aa393b2d64a05f90e7eb9f73e06  applied. The Apache Axis project does not expect to create an Axis 1.x release  fixing this problem, though contributors that would like to work towards  this are welcome.","status":"published","published":"2024-01-06T12:15:42.997Z","modified":"2026-10-26T18:02:36.163819466Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:40.586408Z"},{"id":"GHSA-hr2c-p8rh-238h","title":"Apache Axis Improper Input Validation vulnerability","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Axis allowed users with access to the admin service to perform possible SSRF.\nThis issue affects Apache Axis through 1.3.\n\nAs Axis 1 has been EOL, we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/685c309febc64aa393b2d64a05f90e7eb9f73e06 applied. The Apache Axis project does not expect to create an Axis 1.x release \nfixing this problem, though contributors that would like to work towards this are welcome.","status":"published","published":"2024-01-06T12:30:34Z","modified":"2024-03-14T22:01:29.539084Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20","CWE-918"],"updated_at":"2026-11-02T15:46:49.621585Z"},{"id":"UBUNTU-CVE-2023-51441","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Axis allowed users with access to the admin service to perform possible SSRF This issue affects Apache Axis: through 1.3. As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/685c309febc64aa393b2d64a05f90e7eb9f73e06  applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem, though contributors that would like to work towards  this are welcome.","status":"published","published":"2024-01-06T12:15:00Z","modified":"2026-10-17T12:57:22.190497207Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:23.935133Z"},{"id":"openSUSE-SU-2024:13659-1","title":"axis-1.4-307.1 on GA media","description":"These are all security issues fixed in the axis-1.4-307.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:30:17.407792Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2024:0851-1","title":"Security update for axis","description":"This update for axis fixes the following issues:\n\n- CVE-2023-51441: Fixed SSRF when untrusted input is passed to the service admin HTTP API (bsc#1218605).\n","status":"published","published":"2024-03-12T15:18:20Z","modified":"2026-02-04T04:06:16.623506Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0852-1","title":"Security update for axis","description":"This update for axis fixes the following issues:\n\n\n- CVE-2023-51441: Fixed SSRF when untrusted input is passed to the service admin HTTP API (bsc#1218605).\n","status":"published","published":"2024-03-12T15:18:31Z","modified":"2026-02-04T03:46:18.451879Z","updated_at":"2026-11-02T15:53:54.239786Z"}]}}