CVE-2019-0227: apache apache axis 1.4 Server-Side Request Forgery (SSRF)

CVSS: 7.5v3.1HighModified

AliasesUBUNTU-CVE-2019-0227DEBIAN-CVE-2019-0227GHSA-h9gj-rqrw-x4fq

Published 01-05-2019Last modified 04-08-2024

Vulnerability summary

CVE-2019-0227 is a high (CVSS 7.5) Server-Side Request Forgery (SSRF) vulnerability in apache apache axis 1.4. EPSS estimates a 91.94% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk

58/100

0100

High · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (NVD)

EPSS score

91.94%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits2reference, exploit-database

Timeline

01-05-2019
PublishedVulnerability first disclosed.
04-08-2024
Last modifiedVulnerability information updated.

Description

A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.

CVSS metrics

5 scores · 4 sources · 2 versions

v3.17.5v2.05.4

EPSS trend

Probability

91.94%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 91.94% on 18-09-2026

18-09-202618-10-2026

EPSS score

91.94%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

referenceUnverified
Exploit Reference (rhinosecuritylabs.com)
Maturity: unknown
exploit-databaseremotemultipleUnverified
Apache Axis 1.4 - Remote Code Execution
Maturity: poc