CVE-2023-40743 — Vulnerability in org.apache.axis:axis — CVE Details
CRITICAL
Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getService
Published September 5, 2023Updated February 13, 2025Source: osv
Summary
When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through "ServiceFactory.getService" allows potentially dangerous lookup mechanisms such as LDAP. When passing untrusted input to this API method, this could expose the application to DoS, SSRF and even attacks leading to RCE.
As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. As a workaround, you may review your code to verify no untrusted or unsanitized input is passed to "ServiceFactory.getService", or by applying the patch from https://github.com/apache/axis-axis1-java/commit/7e66753427466590d6def0125e448d2791723210 . The Apache Axis project does not expect to create an Axis 1.x release fixing this problem, though contributors that would like to work towards this are welcome.
Advisory Timeline
- First published September 5, 2023 (1133 days ago).
- Last revised February 13, 2025 — 527 days after initial publication.
Affected Packages (2)
Affects 1 ecosystem: maven (2).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| org.apache.axis:axis | maven | 1.4 | Range-based data available |
| axis:axis | maven | 1.0, 1.1, 1.1-beta, 1.2 (+9 more) | Range-based data available |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-20Improper Input ValidationMITRE
- CWE-75
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-40743ADVISORY
- https://github.com/apache/axis-axis1-java/commit/7e66753427466590d6def0125e448d2791723210WEB
- https://github.com/apache/axis-axis1-javaPACKAGE
- https://lists.apache.org/thread/gs0qgk2mgss7zfhzdd6ftfjvm4kp7v82WEB
- https://lists.debian.org/debian-lts-announce/2023/10/msg00025.htmlWEB
Frequently Asked Questions
- What is CVE-2023-40743?
- Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getService This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
- How do I check if my project is affected by CVE-2023-40743?
- CVE-2023-40743 affects org.apache.axis:axis and axis:axis. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2023-40743 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
9.8
Exploitation is straightforward and causes maximum impact. Patch immediately.
Also Known As
GHSA-rmqp-9w4c-gc7w
Related CVEs
- CVE-2026-107726CRITICAL
Hazelcast allows arbitrary member memory access by low-privileged client
- CVE-2026-107282CRITICAL
AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies