What’s Vulnerable › Vulnerabilities
CVE-2018-8032
- Severity: medium (CVSS 6.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 10.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2018-08-02 · updated 2026-06-17
- Weakness: CWE-79
Description
Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.
Affected products
- Apache Software Foundation Apache Axis: from 1.0 through 1.4
- Debian Linux: 9.0
- Oracle Corporation Oracle Agile Engineering Data Management: 6.2.1.0
- Oracle Corporation Oracle Agile PLM: 9.3.3
- Oracle Corporation Oracle Application Testing Suite: 13.2.0.1, 13.3.0.1
- Oracle Big Data Discovery: 1.6
- Oracle Communications Asap Cartridges: 7.2, 7.3
- Oracle Communications Design Studio: 7.3.4.3.0, 7.3.5.5.0, 7.4.0.4.0, 7.4.1.1.0
- Oracle Communications Element Manager: 8.0.0, 8.1.0, 8.1.1, 8.2.0
- Oracle Communications Network Integrity: 7.3.5, 7.3.6
- Oracle Corporation Oracle Communications Order and Service Management: 7.3.0.0.0, 7.4
- Oracle Communications Session Report Manager: 8.0.0, 8.1.0, 8.1.1, 8.2.0
- Oracle Communications Session Route Manager: 8.0.0, 8.1.0, 8.1.1, 8.2.0
- Oracle Endeca Information Discovery Studio: 3.2.0
- Oracle Corporation Enterprise Manager Base Platform: 12.1.0.5, 13.3.0.0
- Oracle Enterprise Manager For Fusion Middleware: 12.1.0.5
- Oracle Corporation Financial Services Analytical Applications Infrastructure: from 7.3.3 through 7.3.5; from 8.0.0 through 8.0.8
- Oracle Financial Services Compliance Regulatory Reporting: from 8.0.6 through 8.0.8
- Oracle Corporation Financial Services Funds Transfer Pricing: from 8.0.2 through 8.0.7
- Oracle FLEXCUBE Core Banking: 11.7.0, 11.8.0, 11.9.0, 11.10.0
- Oracle Corporation FLEXCUBE Private Banking: 12.0.0, 12.1.0
- Oracle Corporation Hospitality Guest Access: 4.2.0, 4.2.1
- Oracle Instantis Enterprisetrack: 17.1, 17.2, 17.3
- Oracle Corporation Oracle Internet Directory: 12.2.1.3.0, 12.2.1.4.0
- Oracle Corporation Knowledge: from 8.6.0 through 8.6.3
- Oracle Corporation PeopleSoft Enterprise HCM Human Resources: 9.2
- Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.56, 8.57, 8.58
- Oracle Policy Automation Connector For Siebel: 10.4.6
- Oracle Corporation Primavera Gateway: 16.2.11, 17.12.6
- Oracle Corporation Primavera Unifier: from 17.7 through 17.12; 16.1, 16.2, 18.8, 19.12
References
- http://mail-archives.apache.org/mod_mbox/axis-java-dev/201807.mbox/%3CJIRA.13170716.1531060536000.93536.1531060560060%40Atlassian.JIRA%3E
- https://issues.apache.org/jira/browse/AXIS-2924
- https://lists.apache.org/thread.html/3b89bc9e9d055db7eba8835ff6501f3f5db99d2a0928ec0be9b1d17b%40%3Cjava-dev.axis.apache.org%3E
- https://lists.apache.org/thread.html/d06ed5e4eeb77d00e8d594ec01ee8ee1cba173a01ac4b18f1579d041%40%3Cjava-dev.axis.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2021/11/msg00015.html
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpujul2020.html
Get alerted when CVE-2018-8032 or the next vulnerability affects your stack