Cpe:2.3:a:apache:axis2:2.0.1:*:*:*:*:java:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aapacheaxis22.0.1java/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 06 Nov 2026 19:23:09 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgApache Axis2/Java: Cross-site scripting in OpenAPI module (CVE-2026-123766)https://feed.craftedsignal.io/briefs/2026-11-apache-axis2-xss/Fri, 06 Nov 2026 19:23:09 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-apache-axis2-xss/Apache Axis2/Java version 2.0.1 contains a cross-site scripting (XSS) vulnerability in its OpenAPI module caused by improper sanitization of the Host header.Apache Axis2/Java versions prior to 2.0.2 are vulnerable to cross-site scripting (XSS) within the OpenAPI module. The vulnerability occurs because the Swagger UI page improperly handles the Host header, injecting it into the web page content without sanitization. This allows remote attackers to execute arbitrary scripts in the context of the Axis2 origin.

Impact

Successful exploitation allows remote attackers to execute arbitrary scripts in the context of the Axis2 origin, potentially leading to session hijacking or unauthorized actions performed by users viewing the affected Swagger UI page.

Recommendation

  • Update Apache Axis2/Java to version 2.0.2 or later to remediate the underlying XSS vulnerability in the OpenAPI module.
  • As a temporary mitigation, utilize a web application firewall (WAF) to inspect and sanitize the Host header value in incoming requests before they reach the backend application.
]]>mediumadvisory