Vulnerability Description
Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.
CVSS Score
6.1
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Axis | >= 1.0, <= 1.4 |
| Oracle | Agile Engineering Data Management | 6.2.1.0 |
| Oracle | Agile Product Lifecycle Management | 9.3.3 |
| Oracle | Application Testing Suite | 13.2.0.1 |
| Oracle | Big Data Discovery | 1.6 |
| Oracle | Communications Asap Cartridges | 7.2 |
| Oracle | Communications Design Studio | 7.3.4.3.0 |
| Oracle | Communications Element Manager | 8.0.0 |
| Oracle | Communications Network Integrity | 7.3.5 |
| Oracle | Communications Order And Service Management | 7.3.0.0.0 |
| Oracle | Communications Session Report Manager | 8.0.0 |
| Oracle | Communications Session Route Manager | 8.0.0 |
| Oracle | Endeca Information Discovery Studio | 3.2.0 |
| Oracle | Enterprise Manager Base Platform | 12.1.0.5 |
| Oracle | Enterprise Manager For Fusion Middleware | 12.1.0.5 |
| Oracle | Financial Services Analytical Applications Infrastructure | >= 7.3.3, <= 7.3.5 |
| Oracle | Financial Services Compliance Regulatory Reporting | >= 8.0.6, <= 8.0.8 |
| Oracle | Financial Services Funds Transfer Pricing | >= 8.0.2, <= 8.0.7 |
| Oracle | Flexcube Core Banking | 11.7.0 |
| Oracle | Flexcube Private Banking | 12.0.0 |
Related Weaknesses (CWE)
References
- http://mail-archives.apache.org/mod_mbox/axis-java-dev/201807.mbox/%3CJIRA.13170
- https://issues.apache.org/jira/browse/AXIS-2924Issue TrackingPatchVendor Advisory
- https://lists.apache.org/thread.html/3b89bc9e9d055db7eba8835ff6501f3f5db99d2a092
- https://lists.apache.org/thread.html/d06ed5e4eeb77d00e8d594ec01ee8ee1cba173a01ac
- https://lists.debian.org/debian-lts-announce/2021/11/msg00015.htmlMailing ListThird Party Advisory
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://www.oracle.com/security-alerts/cpuApr2021.htmlThird Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2020.htmlThird Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpujan2020.htmlThird Party Advisory
- https://www.oracle.com/security-alerts/cpujan2021.htmlThird Party Advisory
- https://www.oracle.com/security-alerts/cpujul2020.htmlThird Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.htmlThird Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlPatchThird Party Advisory
FAQ
What is CVE-2018-8032?
CVE-2018-8032 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.
How severe is CVE-2018-8032?
CVE-2018-8032 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-8032?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Axis, Oracle Agile Engineering Data Management, Oracle Agile Product Lifecycle Management, Oracle Application Testing Suite, Oracle Big Data Discovery.