← Back

CVE-2019-0227

nvd nist
Published: May 1, 2019Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.6 / Impact: 5.9
Source: NVD

Description

A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.

Affected (77)

Products: Apache: Axis · Oracle: Agile Engineering Data Management, Agile Product Lifecycle Management, Application Testing Suite, Big Data Discovery, Communications Asap Cartridges, Communications Design Studio, Communications Element Manager, Communications Network Integrity, Communications Order And Service Management, Communications Session Report Manager, Communications Session Route Manager, Endeca Information Discovery Studio, Enterprise Manager Base Platform, Enterprise Manager For Fusion Middleware, Financial Services Analytical Applications Infrastructure, Financial Services Compliance Regulatory Reporting, Financial Services Funds Transfer Pricing, Flexcube Core Banking, Flexcube Private Banking, Hospitality Guest Access, Instantis Enterprisetrack, Internet Directory, Knowledge, Peoplesoft Enterprise Human Capital Management Human Resources, Peoplesoft Enterprise Peopletools, Policy Automation Connector For Siebel, Primavera Gateway, Primavera Unifier, Rapid Planning, Real Time Decision Server, Retail Order Broker, Retail Xstore Point Of Service, Secure Global Desktop, Siebel Ui Framework, Tuxedo, Webcenter Portal
Apache
1 product
Axis
Oracle
36 products
Agile Engineering Data Management
Agile Product Lifecycle Management
Application Testing Suite
Big Data Discovery
Communications Asap Cartridges
Communications Design Studio
Communications Element Manager
Communications Network Integrity
Communications Order And Service Management
Communications Session Report Manager
Communications Session Route Manager
Endeca Information Discovery Studio
Enterprise Manager Base Platform
Enterprise Manager For Fusion Middleware
Financial Services Analytical Applications Infrastructure
Financial Services Compliance Regulatory Reporting
Financial Services Funds Transfer Pricing
Flexcube Core Banking
Flexcube Private Banking
Hospitality Guest Access
Instantis Enterprisetrack
Internet Directory
Knowledge
Peoplesoft Enterprise Human Capital Management Human Resources
Peoplesoft Enterprise Peopletools
Policy Automation Connector For Siebel
Primavera Gateway
Primavera Unifier
Rapid Planning
Real Time Decision Server
Retail Order Broker
Retail Xstore Point Of Service
Secure Global Desktop
Siebel Ui Framework
Tuxedo
Webcenter Portal
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Axis
Version 1.4
Configuration B
76 vulnerable
Vulnerable SoftwareAffected Versions
Agile Engineering Data Management
Version 6.2.1.0
Agile Product Lifecycle Management
Version 9.3.3
Oracle
Application Testing Suite
Version 13.2.0.1
Application Testing Suite
Version 13.3.0.1
Big Data Discovery
Version 1.6
Oracle
Communications Asap Cartridges
Version 7.2
Communications Asap Cartridges
Version 7.3
Oracle
Communications Design Studio
Version 7.3.4.3.0
Communications Design Studio
Version 7.3.5.5.0
Communications Design Studio
Version 7.4.0.4.0
Communications Design Studio
Version 7.4.1.1.0
Oracle
Communications Element Manager
Version 8.0.0
Communications Element Manager
Version 8.1.0
Communications Element Manager
Version 8.1.1
Communications Element Manager
Version 8.2.0
Oracle
Communications Network Integrity
Version 7.3.5
Communications Network Integrity
Version 7.3.6
Oracle
Communications Order And Service Management
Version 7.3.0.0.0
Communications Order And Service Management
Version 7.4
Oracle
Communications Session Report Manager
Version 8.0.0
Communications Session Report Manager
Version 8.1.0
Communications Session Report Manager
Version 8.1.1
Communications Session Report Manager
Version 8.2.0
Oracle
Communications Session Route Manager
Version 8.0.0
Communications Session Route Manager
Version 8.1.0
Communications Session Route Manager
Version 8.1.1
Communications Session Route Manager
Version 8.2.0
Endeca Information Discovery Studio
Version 3.2.0
Oracle
Enterprise Manager Base Platform
Version 12.1.0.5
Enterprise Manager Base Platform
Version 13.3.0.0
Enterprise Manager For Fusion Middleware
Version 12.1.0.5
Oracle
Financial Services Analytical Applications Infrastructure
From 7.3.3 to 7.3.5
Financial Services Analytical Applications Infrastructure
From 8.0.0 to 8.0.8
Financial Services Compliance Regulatory Reporting
From 8.0.6 to 8.0.8
Financial Services Funds Transfer Pricing
From 8.0.2 to 8.0.7
Oracle
Flexcube Core Banking
Version 11.10.0
Flexcube Core Banking
Version 11.7.0
Flexcube Core Banking
Version 11.8.0
Flexcube Core Banking
Version 11.9.0
Oracle
Flexcube Private Banking
Version 12.0.0
Flexcube Private Banking
Version 12.1.0
Oracle
Hospitality Guest Access
Version 4.2.0
Hospitality Guest Access
Version 4.2.1
Oracle
Instantis Enterprisetrack
Version 17.1
Instantis Enterprisetrack
Version 17.2
Instantis Enterprisetrack
Version 17.3
Oracle
Internet Directory
Version 12.2.1.3.0
Internet Directory
Version 12.2.1.4.0
Knowledge
From 8.6.0 to 8.6.3
Oracle
Peoplesoft Enterprise Human Capital Management Human Resources
Version 7.3.5
Peoplesoft Enterprise Human Capital Management Human Resources
Version 7.3.6
Peoplesoft Enterprise Human Capital Management Human Resources
Version 9.2
Oracle
Peoplesoft Enterprise Peopletools
Version 8.56
Peoplesoft Enterprise Peopletools
Version 8.57
Peoplesoft Enterprise Peopletools
Version 8.58
Policy Automation Connector For Siebel
Version 10.4.6
Oracle
Primavera Gateway
Version 16.2.11
Primavera Gateway
Version 17.12.6
Oracle
Primavera Unifier
From 17.7 to 17.12
Primavera Unifier
Version 16.1
Primavera Unifier
Version 16.2
Primavera Unifier
Version 18.8
Primavera Unifier
Version 19.12
Oracle
Rapid Planning
Version 12.1
Rapid Planning
Version 12.2
Real Time Decision Server
Version 3.2.1.0
Oracle
Retail Order Broker
Version 15.0
Retail Order Broker
Version 16.0
Retail Order Broker
Version 18.0
Retail Xstore Point Of Service
Version 7.1
Oracle
Secure Global Desktop
Version 5.4
Secure Global Desktop
Version 5.5
Siebel Ui Framework
Up to 21.0
Oracle
Tuxedo
Version 12.1.1.0.0
Tuxedo
Version 12.1.3
Webcenter Portal
Version 12.2.1.3.0

Related CWEs

CWE-918
Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (26)

Source: security@apache.org
Source: security@apache.org
Source: security@apache.org
ExploitThird Party Advisory
Source: security@apache.org
Source: security@apache.org
PatchThird Party Advisory
Source: security@apache.org
PatchThird Party Advisory
Source: security@apache.org
PatchThird Party Advisory
Source: security@apache.org
PatchThird Party Advisory
Source: security@apache.org
PatchThird Party Advisory
Source: security@apache.org
PatchThird Party Advisory
Source: security@apache.org
Source: security@apache.org
PatchThird Party Advisory
Source: security@apache.org
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory

Timeline

No history available yet.