Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/18893?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/18893?format=api", "vulnerability_id": "VCID-zgre-mq7s-ebch", "summary": "Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getService\nWhen integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through \"ServiceFactory.getService\" allows potentially dangerous lookup mechanisms such as LDAP. When passing untrusted input to this API method, this could expose the application to DoS, SSRF and even attacks leading to RCE.\n\nAs Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. As a workaround, you may review your code to verify no untrusted or unsanitized input is passed to \"ServiceFactory.getService\", or by applying the patch from https://github.com/apache/axis-axis1-java/commit/7e66753427466590d6def0125e448d2791723210 . The Apache Axis project does not expect to create an Axis 1.x release fixing this problem, though contributors that would like to work towards this are welcome.", "aliases": [ { "alias": "CVE-2023-40743" }, { "alias": "GHSA-rmqp-9w4c-gc7w" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/583544?format=api", "purl": "pkg:deb/debian/axis@1.4-28%2Bdeb11u1?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/axis@1.4-28%252Bdeb11u1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/1050586?format=api", "purl": "pkg:deb/debian/axis@1.4-28%2Bdeb11u1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/axis@1.4-28%252Bdeb11u1" }, { "url": "http://public2.vulnerablecode.io/api/packages/583545?format=api", "purl": "pkg:deb/debian/axis@1.4-28%2Bdeb12u1?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/axis@1.4-28%252Bdeb12u1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/583546?format=api", "purl": "pkg:deb/debian/axis@1.4-29?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/axis@1.4-29%3Fdistro=trixie" } ], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1050579?format=api", "purl": "pkg:deb/debian/axis@1.4-5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-hj44-args-tfa4" }, { "vulnerability": "VCID-jdjt-ey4h-z3az" }, { "vulnerability": "VCID-xydr-nxmx-wffp" }, { "vulnerability": "VCID-zgre-mq7s-ebch" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/axis@1.4-5" }, { "url": "http://public2.vulnerablecode.io/api/packages/1050580?format=api", "purl": "pkg:deb/debian/axis@1.4-12", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-hj44-args-tfa4" }, { "vulnerability": "VCID-jdjt-ey4h-z3az" }, { "vulnerability": "VCID-xydr-nxmx-wffp" }, { "vulnerability": "VCID-zgre-mq7s-ebch" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/axis@1.4-12" }, { "url": "http://public2.vulnerablecode.io/api/packages/1050581?format=api", "purl": "pkg:deb/debian/axis@1.4-12%2Bdeb6u1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-hj44-args-tfa4" }, { "vulnerability": "VCID-jdjt-ey4h-z3az" }, { "vulnerability": "VCID-xydr-nxmx-wffp" }, { "vulnerability": "VCID-zgre-mq7s-ebch" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/axis@1.4-12%252Bdeb6u1" }, { "url": "http://public2.vulnerablecode.io/api/packages/1050582?format=api", "purl": "pkg:deb/debian/axis@1.4-16.2%2Bdeb7u1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-jdjt-ey4h-z3az" }, { "vulnerability": "VCID-xydr-nxmx-wffp" }, { "vulnerability": "VCID-zgre-mq7s-ebch" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/axis@1.4-16.2%252Bdeb7u1" }, { "url": "http://public2.vulnerablecode.io/api/packages/1050583?format=api", "purl": "pkg:deb/debian/axis@1.4-22", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-jdjt-ey4h-z3az" }, { "vulnerability": "VCID-zgre-mq7s-ebch" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/axis@1.4-22" }, { "url": "http://public2.vulnerablecode.io/api/packages/1050584?format=api", "purl": "pkg:deb/debian/axis@1.4-25", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-jdjt-ey4h-z3az" }, { "vulnerability": "VCID-zgre-mq7s-ebch" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/axis@1.4-25" }, { "url": "http://public2.vulnerablecode.io/api/packages/1050585?format=api", "purl": "pkg:deb/debian/axis@1.4-28", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-zgre-mq7s-ebch" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/axis@1.4-28" }, { "url": "http://public2.vulnerablecode.io/api/packages/178401?format=api", "purl": "pkg:maven/axis/axis@1.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-hj44-args-tfa4" }, { "vulnerability": "VCID-jdjt-ey4h-z3az" }, { "vulnerability": "VCID-mbzz-vcd2-mfeb" }, { "vulnerability": "VCID-zgre-mq7s-ebch" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/axis/axis@1.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/178402?format=api", "purl": "pkg:maven/axis/axis@1.1-beta", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-hj44-args-tfa4" }, { "vulnerability": "VCID-jdjt-ey4h-z3az" }, { "vulnerability": "VCID-mbzz-vcd2-mfeb" }, { "vulnerability": "VCID-zgre-mq7s-ebch" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/axis/axis@1.1-beta" }, { "url": "http://public2.vulnerablecode.io/api/packages/178403?format=api", "purl": "pkg:maven/axis/axis@1.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-hj44-args-tfa4" }, { "vulnerability": "VCID-jdjt-ey4h-z3az" }, { "vulnerability": "VCID-mbzz-vcd2-mfeb" }, { "vulnerability": "VCID-zgre-mq7s-ebch" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/axis/axis@1.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/178404?format=api", "purl": "pkg:maven/axis/axis@1.2-alpha-1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-hj44-args-tfa4" }, { "vulnerability": "VCID-jdjt-ey4h-z3az" }, { "vulnerability": "VCID-mbzz-vcd2-mfeb" }, { "vulnerability": "VCID-zgre-mq7s-ebch" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/axis/axis@1.2-alpha-1" }, { "url": "http://public2.vulnerablecode.io/api/packages/178405?format=api", "purl": "pkg:maven/axis/axis@1.2-beta-2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-hj44-args-tfa4" }, { "vulnerability": "VCID-jdjt-ey4h-z3az" }, { "vulnerability": "VCID-mbzz-vcd2-mfeb" }, { "vulnerability": "VCID-zgre-mq7s-ebch" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/axis/axis@1.2-beta-2" }, { "url": "http://public2.vulnerablecode.io/api/packages/178406?format=api", "purl": "pkg:maven/axis/axis@1.2-beta-3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-hj44-args-tfa4" }, { "vulnerability": "VCID-jdjt-ey4h-z3az" }, { "vulnerability": "VCID-mbzz-vcd2-mfeb" }, { "vulnerability": "VCID-zgre-mq7s-ebch" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/axis/axis@1.2-beta-3" }, { "url": "http://public2.vulnerablecode.io/api/packages/178407?format=api", "purl": "pkg:maven/axis/axis@1.2-RC1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-hj44-args-tfa4" }, { "vulnerability": "VCID-jdjt-ey4h-z3az" }, { "vulnerability": "VCID-mbzz-vcd2-mfeb" }, { "vulnerability": "VCID-zgre-mq7s-ebch" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/axis/axis@1.2-RC1" }, { "url": "http://public2.vulnerablecode.io/api/packages/178408?format=api", "purl": "pkg:maven/axis/axis@1.2-RC2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-hj44-args-tfa4" }, { "vulnerability": "VCID-jdjt-ey4h-z3az" }, { "vulnerability": "VCID-mbzz-vcd2-mfeb" }, { "vulnerability": "VCID-zgre-mq7s-ebch" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/axis/axis@1.2-RC2" }, { "url": "http://public2.vulnerablecode.io/api/packages/178409?format=api", "purl": "pkg:maven/axis/axis@1.2-RC3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-hj44-args-tfa4" }, { "vulnerability": "VCID-jdjt-ey4h-z3az" }, { "vulnerability": "VCID-mbzz-vcd2-mfeb" }, { "vulnerability": "VCID-zgre-mq7s-ebch" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/axis/axis@1.2-RC3" }, { "url": "http://public2.vulnerablecode.io/api/packages/178410?format=api", "purl": "pkg:maven/axis/axis@1.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-hj44-args-tfa4" }, { "vulnerability": "VCID-jdjt-ey4h-z3az" }, { "vulnerability": "VCID-mbzz-vcd2-mfeb" }, { "vulnerability": "VCID-zgre-mq7s-ebch" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/axis/axis@1.2" }, { "url": "http://public2.vulnerablecode.io/api/packages/178411?format=api", "purl": "pkg:maven/axis/axis@1.2.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-hj44-args-tfa4" }, { "vulnerability": "VCID-jdjt-ey4h-z3az" }, { "vulnerability": "VCID-mbzz-vcd2-mfeb" }, { "vulnerability": "VCID-zgre-mq7s-ebch" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/axis/axis@1.2.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/144894?format=api", "purl": "pkg:maven/axis/axis@1.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-24xc-gnxw-5qhq" }, { "vulnerability": "VCID-hj44-args-tfa4" }, { "vulnerability": "VCID-jdjt-ey4h-z3az" }, { "vulnerability": "VCID-mbzz-vcd2-mfeb" }, { "vulnerability": "VCID-zgre-mq7s-ebch" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/axis/axis@1.3" }, { "url": "http://public2.vulnerablecode.io/api/packages/31596?format=api", "purl": "pkg:maven/axis/axis@1.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-hj44-args-tfa4" }, { "vulnerability": "VCID-jdjt-ey4h-z3az" }, { "vulnerability": "VCID-mbzz-vcd2-mfeb" }, { "vulnerability": "VCID-xydr-nxmx-wffp" }, { "vulnerability": "VCID-zgre-mq7s-ebch" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/axis/axis@1.4" }, { "url": "http://public2.vulnerablecode.io/api/packages/20776?format=api", "purl": "pkg:maven/org.apache.axis/axis@1.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-hj44-args-tfa4" }, { "vulnerability": "VCID-jdjt-ey4h-z3az" }, { "vulnerability": "VCID-mbzz-vcd2-mfeb" }, { "vulnerability": "VCID-xydr-nxmx-wffp" }, { "vulnerability": "VCID-zgre-mq7s-ebch" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.axis/axis@1.4" } ], "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-40743", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00959", "scoring_system": "epss", "scoring_elements": "0.76499", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00959", "scoring_system": "epss", "scoring_elements": "0.76544", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.00959", "scoring_system": "epss", "scoring_elements": "0.76531", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.00959", "scoring_system": "epss", "scoring_elements": "0.76525", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00959", "scoring_system": "epss", "scoring_elements": "0.76491", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00959", "scoring_system": "epss", "scoring_elements": "0.76503", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.01164", "scoring_system": "epss", "scoring_elements": "0.78569", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.01164", "scoring_system": "epss", "scoring_elements": "0.786", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.01164", "scoring_system": "epss", "scoring_elements": "0.78582", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.01164", "scoring_system": "epss", "scoring_elements": "0.78607", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.01164", "scoring_system": "epss", "scoring_elements": "0.78614", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.01164", "scoring_system": "epss", "scoring_elements": "0.78638", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.01164", "scoring_system": "epss", "scoring_elements": "0.7862", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.01164", "scoring_system": "epss", "scoring_elements": "0.78612", "published_at": "2026-04-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-40743" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40743", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40743" }, { "reference_url": "https://github.com/apache/axis-axis1-java", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/axis-axis1-java" }, { "reference_url": "https://github.com/apache/axis-axis1-java/commit/7e66753427466590d6def0125e448d2791723210", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-07-18T15:52:10Z/" } ], "url": "https://github.com/apache/axis-axis1-java/commit/7e66753427466590d6def0125e448d2791723210" }, { "reference_url": "https://lists.apache.org/thread/gs0qgk2mgss7zfhzdd6ftfjvm4kp7v82", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-07-18T15:52:10Z/" } ], "url": "https://lists.apache.org/thread/gs0qgk2mgss7zfhzdd6ftfjvm4kp7v82" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00025.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-07-18T15:52:10Z/" } ], "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00025.html" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1051288", "reference_id": "1051288", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1051288" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40743", "reference_id": "CVE-2023-40743", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40743" }, { "reference_url": "https://github.com/advisories/GHSA-rmqp-9w4c-gc7w", "reference_id": "GHSA-rmqp-9w4c-gc7w", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-rmqp-9w4c-gc7w" }, { "reference_url": "https://usn.ubuntu.com/6470-1/", "reference_id": "USN-6470-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/6470-1/" } ], "weaknesses": [ { "cwe_id": 20, "name": "Improper Input Validation", "description": "The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly." }, { "cwe_id": 75, "name": "Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)", "description": "The product does not adequately filter user-controlled input for special elements with control implications." }, { "cwe_id": 937, "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013." }, { "cwe_id": 1035, "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017." } ], "exploits": [], "severity_range_score": "9.0 - 10.0", "exploitability": "0.5", "weighted_severity": "9.0", "risk_score": 4.5, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-zgre-mq7s-ebch" }