{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/axis2/java--2.0.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-123753"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Axis2/Java (\u003c 2.0.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Axis2/Java versions prior to 2.0.2 are vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can supply a non-anonymous WS-Addressing 'wsa:ReplyTo' or 'wsa:FaultTo' header, causing the service to initiate a connection to the specified address. This can lead to unauthorized access to internal resources or sensitive network infrastructure.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows attackers to perform requests to internal hosts accessible by the Axis2 server, potentially bypassing network segmentation or accessing internal services that do not require authentication.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Apache Axis2/Java to version 2.0.2 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit web server and application logs for unusual 'wsa:ReplyTo' or 'wsa:FaultTo' address patterns in SOAP headers.\u003c/li\u003e\n\u003cli\u003eRestrict egress traffic from the application server to prevent unauthorized internal network access.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-06T19:23:13Z","date_published":"2026-11-06T19:23:13Z","id":"https://feed.craftedsignal.io/briefs/2026-11-axis2-ssrf/","summary":"Apache Axis2/Java versions prior to 2.0.2 are vulnerable to unauthenticated SSRF, allowing attackers to force the server to initiate requests to arbitrary network destinations.","title":"Apache Axis2/Java: SSRF via WS-Addressing endpoints (CVE-2026-123753)","url":"https://feed.craftedsignal.io/briefs/2026-11-axis2-ssrf/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:axis2:2.0.1:*:*:*:*:java:*:*"],"_cs_cves":[{"id":"CVE-2026-123766"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Axis2/Java (\u003c 2.0.2)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Axis2/Java versions prior to 2.0.2 are vulnerable to cross-site scripting (XSS) within the OpenAPI module. The vulnerability occurs because the Swagger UI page improperly handles the Host header, injecting it into the web page content without sanitization. This allows remote attackers to execute arbitrary scripts in the context of the Axis2 origin.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows remote attackers to execute arbitrary scripts in the context of the Axis2 origin, potentially leading to session hijacking or unauthorized actions performed by users viewing the affected Swagger UI page.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Apache Axis2/Java to version 2.0.2 or later to remediate the underlying XSS vulnerability in the OpenAPI module.\u003c/li\u003e\n\u003cli\u003eAs a temporary mitigation, utilize a web application firewall (WAF) to inspect and sanitize the Host header value in incoming requests before they reach the backend application.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-06T19:23:09Z","date_published":"2026-11-06T19:23:09Z","id":"https://feed.craftedsignal.io/briefs/2026-11-apache-axis2-xss/","summary":"Apache Axis2/Java version 2.0.1 contains a cross-site scripting (XSS) vulnerability in its OpenAPI module caused by improper sanitization of the Host header.","title":"Apache Axis2/Java: Cross-site scripting in OpenAPI module (CVE-2026-123766)","url":"https://feed.craftedsignal.io/briefs/2026-11-apache-axis2-xss/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:axis2:*:*:*:*:*:java:*:*"],"_cs_cves":[{"id":"CVE-2026-120367"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Axis2/Java (\u003c 2.0.2)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Axis2/Java versions before 2.0.2 contain an \u0026quot;Allocation of Resources Without Limits or Throttling\u0026quot; vulnerability. The JSON message builders, specifically the Gson, Moshi, and HTTP/2 variants, buffer the entire request body into memory without size constraints. An unauthenticated attacker can exploit this behavior by sending a specially crafted, excessively large JSON request to the server, resulting in memory exhaustion and a potential denial-of-service (DoS) condition. Version 2.0.2 introduces configurable limits to mitigate this risk.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe primary risk is a denial-of-service condition caused by heap memory exhaustion, which can crash the JVM or cause severe performance degradation for the affected service.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Apache Axis2/Java to version 2.0.2 or later to enable configurable request body size limits.\u003c/li\u003e\n\u003cli\u003eImplement upstream request size restrictions at the WAF or reverse proxy layer to drop excessively large HTTP POST requests before they reach the Axis2 service.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-06T19:23:03Z","date_published":"2026-11-06T19:23:03Z","id":"https://feed.craftedsignal.io/briefs/2026-11-apache-axis2-json-dos/","summary":"Apache Axis2/Java versions prior to 2.0.2 are vulnerable to a denial-of-service condition where unauthenticated attackers can exhaust server memory by sending large, unbounded JSON requests.","title":"Apache Axis2/Java: Unbounded JSON request body memory exhaustion (CVE-2026-120367)","url":"https://feed.craftedsignal.io/briefs/2026-11-apache-axis2-json-dos/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:axis2:*:*:*:*:*:java:*:*"],"_cs_cves":[{"id":"CVE-2026-123779"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Axis2/Java (\u003c 2.0.2)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Axis2/Java is vulnerable to forced browsing due to inconsistent enforcement of the exposeServiceMetadata configuration parameter. While the parameter is intended to disable metadata exposure, it fails to restrict access to packaged .wsdl and .xsd files, as well as the named-WSDL ?wsdl=NAME route in the standalone HTTP server. This vulnerability allows an attacker to retrieve service metadata even when explicitly disabled.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability may lead to unauthorized information disclosure of internal service configurations and API definitions, potentially aiding further reconnaissance of the target infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Apache Axis2/Java to version 2.0.2 or later to ensure the exposeServiceMetadata configuration is correctly enforced across all metadata endpoints.\u003c/li\u003e\n\u003cli\u003eReview public-facing Axis2/Java instances to identify and restrict access to sensitive WSDL and XSD metadata routes until patches are applied.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-06T19:22:53Z","date_published":"2026-11-06T19:22:53Z","id":"https://feed.craftedsignal.io/briefs/2026-11-axis2-forced-browsing/","summary":"Apache Axis2/Java contains a forced browsing vulnerability where the exposeServiceMetadata parameter is not enforced on specific routes, allowing unauthorized metadata disclosure.","title":"Apache Axis2/Java: Inconsistent enforcement of exposeServiceMetadata (CVE-2026-123779)","url":"https://feed.craftedsignal.io/briefs/2026-11-axis2-forced-browsing/"}],"language":"en","title":"CraftedSignal Threat Feed - Axis2/Java (\u003c 2.0.2)","version":"https://jsonfeed.org/version/1.1"}