What’s Vulnerable › Vulnerabilities
CVE-2019-0227
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 91.9% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2019-05-01 · updated 2026-06-17
- Weakness: CWE-918
Description
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.
Affected products
- Apache Software Foundation Apache Axis: 1.4
- Oracle Corporation Oracle Agile Engineering Data Management: 6.2.1.0
- Oracle Corporation Oracle Agile PLM: 9.3.3
- Oracle Corporation Oracle Application Testing Suite: 13.2.0.1, 13.3.0.1
- Oracle Big Data Discovery: 1.6
- Oracle Communications Asap Cartridges: 7.2, 7.3
- Oracle Communications Design Studio: 7.3.4.3.0, 7.3.5.5.0, 7.4.0.4.0, 7.4.1.1.0
- Oracle Communications Element Manager: 8.0.0, 8.1.0, 8.1.1, 8.2.0
- Oracle Communications Network Integrity: 7.3.5, 7.3.6
- Oracle Corporation Oracle Communications Order and Service Management: 7.3.0.0.0, 7.4
- Oracle Communications Session Report Manager: 8.0.0, 8.1.0, 8.1.1, 8.2.0
- Oracle Communications Session Route Manager: 8.0.0, 8.1.0, 8.1.1, 8.2.0
- Oracle Endeca Information Discovery Studio: 3.2.0
- Oracle Corporation Enterprise Manager Base Platform: 12.1.0.5, 13.3.0.0
- Oracle Enterprise Manager For Fusion Middleware: 12.1.0.5
- Oracle Corporation Financial Services Analytical Applications Infrastructure: from 7.3.3 through 7.3.5; from 8.0.0 through 8.0.8
- Oracle Financial Services Compliance Regulatory Reporting: from 8.0.6 through 8.0.8
- Oracle Corporation Financial Services Funds Transfer Pricing: from 8.0.2 through 8.0.7
- Oracle FLEXCUBE Core Banking: 11.7.0, 11.8.0, 11.9.0, 11.10.0
- Oracle Corporation FLEXCUBE Private Banking: 12.0.0, 12.1.0
- Oracle Corporation Hospitality Guest Access: 4.2.0, 4.2.1
- Oracle Instantis Enterprisetrack: 17.1, 17.2, 17.3
- Oracle Corporation Oracle Internet Directory: 12.2.1.3.0, 12.2.1.4.0
- Oracle Corporation Knowledge: from 8.6.0 through 8.6.3
- Oracle Corporation PeopleSoft Enterprise HCM Human Resources: 7.3.5, 7.3.6, 9.2
- Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.56, 8.57, 8.58
- Oracle Policy Automation Connector For Siebel: 10.4.6
- Oracle Corporation Primavera Gateway: 16.2.11, 17.12.6
- Oracle Corporation Primavera Unifier: from 17.7 through 17.12; 16.1, 16.2, 18.8, 19.12
- Oracle Corporation Rapid Planning: 12.1, 12.2
References
- https://lists.apache.org/thread.html/r3a5baf5d76f1f2181be7f54da3deab70d7a38b5660b387583d05a8cd%40%3Cjava-user.axis.apache.org%3E
- https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E
- https://rhinosecuritylabs.com/application-security/cve-2019-0227-expired-domain-rce-apache-axis/
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
Get alerted when CVE-2019-0227 or the next vulnerability affects your stack