{"id":"CVE-2019-0227","url":"https://www.cyber-defence.io/tools/cve/CVE-2019-0227","generatedAt":"2026-10-28T21:28:42.444Z","title":"A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006.","description":"A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.","published":"2019-05-01T21:29:01.000Z","lastModified":"2026-06-17T02:08:02.000Z","status":"Modified","sourceIdentifier":"security@apache.org","cvss":{"version":"3.1","score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-918"],"affected":["apache/axis","oracle/agile engineering data management","oracle/agile product lifecycle management","oracle/application testing suite","oracle/big data discovery","oracle/communications asap cartridges","oracle/communications design studio","oracle/communications element manager","oracle/communications network integrity","oracle/communications order and service management","oracle/communications session report manager","oracle/communications session route manager","oracle/endeca information discovery studio","oracle/enterprise manager base platform","oracle/enterprise manager for fusion middleware","oracle/financial services analytical applications infrastructure","oracle/financial services compliance regulatory reporting","oracle/financial services funds transfer pricing","oracle/flexcube core banking","oracle/flexcube private banking","oracle/hospitality guest access","oracle/instantis enterprisetrack","oracle/internet directory","oracle/knowledge","oracle/peoplesoft enterprise human capital management human resources","oracle/peoplesoft enterprise peopletools","oracle/policy automation connector for siebel","oracle/primavera gateway","oracle/primavera unifier","oracle/rapid planning","oracle/real-time decision server","oracle/retail order broker","oracle/retail xstore point of service","oracle/secure global desktop","oracle/siebel ui framework","oracle/tuxedo","oracle/webcenter portal"],"epss":{"score":0.9194,"percentile":0.99818,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":1,"verified":false,"firstPublished":"2019-04-09","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":46682,"kind":"exploit","title":"Apache Axis 1.4 - Remote Code Execution","url":"https://www.exploit-db.com/exploits/46682","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/46682.py","file":"exploits/multiple/remote/46682.py","published":"2019-04-09","added":"2019-04-09","updated":"2019-04-09","author":"David Yesland","type":"remote","platform":"multiple","port":null,"verified":false,"codes":["CVE-2019-0227"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://github.com/RhinoSecurityLabs/CVEs/blob/d5d317bb211af59d0708fd602d83bd80b61ae37b/CVE-2019-0227/CVE-2019-0227.py"}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 91.9%, higher than 100% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"https://lists.apache.org/thread.html/r3a5baf5d76f1f2181be7f54da3deab70d7a38b5660b387583d05a8cd%40%3Cjava-user.axis.apache.org%3E","source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E","source":"security@apache.org"},{"url":"https://rhinosecuritylabs.com/application-security/cve-2019-0227-expired-domain-rce-apache-axis/","tags":["Exploit","Third Party Advisory"],"source":"security@apache.org"},{"url":"https://security.netapp.com/advisory/ntap-20240621-0006/","source":"security@apache.org"},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["Patch","Third Party Advisory"],"source":"security@apache.org"},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["Patch","Third Party Advisory"],"source":"security@apache.org"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["Patch","Third Party Advisory"],"source":"security@apache.org"},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["Patch","Third Party Advisory"],"source":"security@apache.org"},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["Patch","Third Party Advisory"],"source":"security@apache.org"},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":["Patch","Third Party Advisory"],"source":"security@apache.org"},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","source":"security@apache.org"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["Patch","Third Party Advisory"],"source":"security@apache.org"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","tags":["Patch","Third Party Advisory"],"source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/r3a5baf5d76f1f2181be7f54da3deab70d7a38b5660b387583d05a8cd%40%3Cjava-user.axis.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://rhinosecuritylabs.com/application-security/cve-2019-0227-expired-domain-rce-apache-axis/","tags":["Exploit","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20240621-0006/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-0227","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}