Cross-Site Scripting Vulnerability in Apache Axis 1.x by Apache
CVE-2018-8032

6.1MEDIUM

Key Information:

Vendor
Apache
Status
Apache Axis
Vendor
CVE Published:
2 August 2018

Badges

👾 Exploit Exists🟡 Public PoC

Summary

Apache Axis versions up to and including 1.4 contain a vulnerability that allows attackers to perform cross-site scripting (XSS) attacks via the default servlet/services. This flaw could enable an attacker to inject malicious scripts into web pages viewed by users, potentially compromising session information or executing unauthorized actions on behalf of the victim. It is imperative for users of affected versions to apply appropriate security patches to mitigate the risks associated with this vulnerability.

Affected Version(s)

Apache Axis 1.x up to and including 1.4

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2018-8032
Created by cairuojin

References

http://mail-archives.apache.org/mod_mbox/axis-java-dev/20...
mailing-list
https://lists.apache.org/thread.html/d06ed5e4eeb77d00e8d5...
mailing-list
https://lists.apache.org/thread.html/3b89bc9e9d055db7eba8...
mailing-list

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.