{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aapacheaxis22.0.1java/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:axis2:2.0.1:*:*:*:*:java:*:*"],"_cs_cves":[{"id":"CVE-2026-123766"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Axis2/Java (\u003c 2.0.2)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Axis2/Java versions prior to 2.0.2 are vulnerable to cross-site scripting (XSS) within the OpenAPI module. The vulnerability occurs because the Swagger UI page improperly handles the Host header, injecting it into the web page content without sanitization. This allows remote attackers to execute arbitrary scripts in the context of the Axis2 origin.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows remote attackers to execute arbitrary scripts in the context of the Axis2 origin, potentially leading to session hijacking or unauthorized actions performed by users viewing the affected Swagger UI page.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Apache Axis2/Java to version 2.0.2 or later to remediate the underlying XSS vulnerability in the OpenAPI module.\u003c/li\u003e\n\u003cli\u003eAs a temporary mitigation, utilize a web application firewall (WAF) to inspect and sanitize the Host header value in incoming requests before they reach the backend application.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-06T19:23:09Z","date_published":"2026-11-06T19:23:09Z","id":"https://feed.craftedsignal.io/briefs/2026-11-apache-axis2-xss/","summary":"Apache Axis2/Java version 2.0.1 contains a cross-site scripting (XSS) vulnerability in its OpenAPI module caused by improper sanitization of the Host header.","title":"Apache Axis2/Java: Cross-site scripting in OpenAPI module (CVE-2026-123766)","url":"https://feed.craftedsignal.io/briefs/2026-11-apache-axis2-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:apache:axis2:2.0.1:*:*:*:*:java:*:*","version":"https://jsonfeed.org/version/1.1"}