Apache Axis 1.x (EOL) may allow SSRF when untrusted input is passed to the service admin HTTP API

CVE-2023-51441

Summary

An input validation vulnerability in Apache Axis enables users with access to the admin service to potentially execute Server-Side Request Forgery (SSRF) attacks. This vulnerability impacts users of Apache Axis version 1.3 and earlier. As Apache Axis 1 has reached its End of Life (EOL), migrating to a modern SOAP engine, such as Apache Axis 2/Java, is highly recommended. Alternatively, users can utilize a fork of Axis that includes a specific patch designed to remediate the vulnerability. Future releases of Axis 1.x addressing this issue are not anticipated, and community contributions to develop such a release may be welcomed.

References