axis-1.2.jar: 3 vulnerabilities (highest severity is: 6.1)

[dev-mend-for-github-com]

Vulnerable Library - axis-1.2.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /itory/axis/axis/1.2/axis-1.2.jar

Found in HEAD commit: 6eec0db100f5fcde5668a4686fcde7faf305a031

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2018-8032	Medium	6.1	axis-1.2.jar	Direct	N/A	❌
CVE-2014-3596	Medium	5.5	axis-1.2.jar	Direct	1.3-atlassian-1	✅
CVE-2012-5784	Medium	4.8	axis-1.2.jar	Direct	axis - 1.2.1,1.2.1;jasperreports-server-pro - 5.5.0,5.5.0;devtoolset-2-axis - 1.4,1.4;axis-javadoc - 1.2.1;axis-manual - 1.2.1	❌

Details

CVE-2018-8032

Vulnerable Library - axis-1.2.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /itory/axis/axis/1.2/axis-1.2.jar

Dependency Hierarchy:

• ❌ axis-1.2.jar (Vulnerable Library)

Found in HEAD commit: 6eec0db100f5fcde5668a4686fcde7faf305a031

Found in base branch: main

Vulnerability Details

Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.

Publish Date: 2018-08-02

URL: CVE-2018-8032

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

CVE-2014-3596

Vulnerable Library - axis-1.2.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /itory/axis/axis/1.2/axis-1.2.jar

Dependency Hierarchy:

• ❌ axis-1.2.jar (Vulnerable Library)

Found in HEAD commit: 6eec0db100f5fcde5668a4686fcde7faf305a031

Found in base branch: main

Vulnerability Details

The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.

Publish Date: 2014-08-27

URL: CVE-2014-3596

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: N/A
  • Attack Complexity: N/A
  • Privileges Required: N/A
  • User Interaction: N/A
  • Scope: N/A
• Impact Metrics:
  • Confidentiality Impact: N/A
  • Integrity Impact: N/A
  • Availability Impact: N/A

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2014-3596

Release Date: 2014-08-27

Fix Resolution: 1.3-atlassian-1

⛑️ Automatic Remediation is available for this issue

CVE-2012-5784

Vulnerable Library - axis-1.2.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /itory/axis/axis/1.2/axis-1.2.jar

Dependency Hierarchy:

• ❌ axis-1.2.jar (Vulnerable Library)

Found in HEAD commit: 6eec0db100f5fcde5668a4686fcde7faf305a031

Found in base branch: main

Vulnerability Details

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Publish Date: 2012-11-04

URL: CVE-2012-5784

CVSS 3 Score Details (4.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2012-5784

Release Date: 2012-11-04

Fix Resolution: axis - 1.2.1,1.2.1;jasperreports-server-pro - 5.5.0,5.5.0;devtoolset-2-axis - 1.4,1.4;axis-javadoc - 1.2.1;axis-manual - 1.2.1

---

⛑️ Automatic Remediation is available for this issue.