Read the docs
TI-2023-21517 Aliases CVE-2023-40743GHSA-rmqp-9w4c-gc7w

Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getService

Priority MEDIUM 55CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.

Summary

** UNSUPPORTED WHEN ASSIGNED ** When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through "ServiceFactory.getService" allows potentially dangerous lookup mechanisms such as LDAP. When passing untrusted input to this API method, this could expose the application to DoS, SSRF and even attacks leading to RCE. As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. As a workaround, you may review your code to verify no untrusted or unsanitized input is passed to "ServiceFactory.getService", or by applying the patch from https://github.com/apache/axis-axis1-java/commit/7e66753427466590d6def0125e448d2791723210 . The Apache Axis project does not expect to create an Axis 1.x release fixing this problem, though contributors that would like to work towards this are welcome.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03281 88th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Axisup to 1.3—No fix listedCNA
—org.apache.axis:axis (Maven)up to 1.4—No fix listedGHSA-rmqp-9w4c-gc7w
—axis:axis (Maven)up to 1.4—No fix listedGHSA-rmqp-9w4c-gc7w
  • Apache Axis VendorApache Affected up to 1.3 Fixed in — No fix listed CNA
  • org.apache.axis:axis (Maven) Vendor— Affected up to 1.4 Fixed in — No fix listed GHSA-rmqp-9w4c-gc7w
  • axis:axis (Maven) Vendor— Affected up to 1.4 Fixed in — No fix listed GHSA-rmqp-9w4c-gc7w

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:axis:*:*:*:*:*:*:*:*before 2023-08-01VulnerableApache
  • cpe:2.3:a:apache:axis:*:*:*:*:*:*:*:* Versions before 2023-08-01 Vulnerable ·Apache

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-40743
  2. 2026-10-03 Alias added: GHSA-rmqp-9w4c-gc7w

References

Patch 2

Advisory 1

Other 2

  • TI-2019-00200 Server-side request forgery in Apache Axis 1.4 CVSS 3.1HIGH 7.5
  • TI-2007-02271 Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a… CVSS 2.0MEDIUM 5.0
  • TI-2023-28095 Apache Axis 1.x (EOL) may allow SSRF when untrusted input is passed to the service admin HTTP API CVSS 3.1HIGH 7.2
  • TI-2018-05809 Cross-site scripting in Apache Axis CVSS 3.1MEDIUM 6.1
  • TI-2014-02919 The getCN function in Apache Axis 1.4 and earlier does not properly verify that the… CVSS 2.0MEDIUM 5.8
  • TI-2012-04825 Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal… CVSS 2.0MEDIUM 5.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences