CVE-2023-40743

Summary

CVE-2023-40743: Unsupported Apache Axis 1.x may allow dangerous lookup mechanisms when using "ServiceFactory.getService." Untrusted input passed to this API method can lead to Denial of Service (DoS), Server Side Request Forgery (SSRF), and even Remote Code Execution (RCE). As Apache Axis 1 has reached End of Life, it is recommended to migrate to a different SOAP engine, such as Apache Axis 2 or Java. Alternatively, code review to prevent untrusted or unsanitized input from being passed to "ServiceFactory.getService" or applying the available patch can be considered. The Apache Axis project does not plan to release a fix for this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.