Description
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache | Apache Axis 1.4 | Apache Axis 1.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | axis | 1.4-30 | — |
| Debian 13 | axis | No fix yet | — |
| Debian 12 | axis | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | axis | No fix yet | — |
| Ubuntu 26.04 LTS | axis | No fix yet | — |
| Ubuntu 25.10 | axis | No fix yet | — |
| Ubuntu 24.04 LTS | axis | No fix yet | — |
| Ubuntu 22.04 LTS | axis | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | axis | No fix yet | — |
| Ubuntu Pro 18.04 LTS | axis | No fix yet | — |
| Ubuntu Pro 16.04 LTS | axis | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Apache Axis 1.4 - Remote Code Execution EDB-46682 · remote · Apr 9, 2019
GitHub 2 repositories
-
ianxtianxt/cve-2019-0227 ★ 4 · Oct 27, 2019
apache axis1.4远程代码执行漏洞
-
1475210817/Axis1.4-CVE-2019-0227 ★ 0 · May 16, 2026
Apache Axis1.4 远程命令执行漏洞利用工具 - CVE-2019-0227，支持随机化服务名和Webshell文件名
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | axis:axis | <= 1.4 | — | GHSA-h9gj-rqrw-x4fq |
| Maven | org.apache.axis:axis | <= 1.4 | — | GHSA-h9gj-rqrw-x4fq |
Advisories 4
- WID-SEC-2024-2181 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 18, 2024
- WID-SEC-2024-2180 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 18, 2024
- WID-SEC-2023-2946 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 16, 2023
- WID-SEC-2023-0273 IBM Maximo Asset Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 2, 2023
References
- https://rhinosecuritylabs.com/application-security/cve-2019-0227-expired-domain-rce-apache-axis/
- [announce] 20200131 Apache Software Foundation Security Report: 2019 mailing-list
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- [axis-java-user] 20210928 [Axis2] Migration Issues mailing-list
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://security.netapp.com/advisory/ntap-20240621-0006/