logo

Database

Technical information leak In org.apache.axis:axis

Description

Apache Axis allows Exposure of Sensitive Information to an Unauthorized Actor Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installation path in the resulting exception message.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2007-23532. NVD-2007-23533. OSV-DEBIAN-2007-23534. OSV-2007-23535. GCVE-2007-23536. SECURITY-TRACKER-CVE-2007-2353

References

1. https://www.exploit-db.com/exploits/299302. https://github.com/albfernandez/axis1-java/issues/34#issuecomment-10066931103. https://github.com/albfernandez/axis1-java/commit/32f35038ecae2c7a7f2e904b2289fd383f6f4d1f4. https://github.com/apache/axis-axis1-java/commit/2fdbb91c5e861e804db70cada188b1d7c16035135. https://github.com/apache/axis-axis1-java/commit/7ba89deb2eb21615630f18e96a35bfdec7f7cfed6. https://exchange.xforce.ibmcloud.com/vulnerabilities/341677. http://attrition.org/pipermail/vim/2007-April/001562.html

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.