Package URl

pkg:maven/org.apache.axis2/addressing@1.8.0

CPE

cpe:2.3:a:apache:axis:*:*:*:*:*:*:*:* versions up to (excluding) 2023-08-01

CVE

CVE-2023-40743

ODC Integration

None

ODC Version

8.2.1

Description

CVE description says the package is org.apache.axis group, but the CVE is been reported in org.apache.axis2.
Recommendation in the CVE database asks to use axis2 package instead of axis as workaround.
Does this mean the CVE is reported false positive or a valid one?

Gradle code:
implementation group: 'org.apache.axis2', name: 'addressing', version: '1.8.0', classifier: 'classpath-module'