CVE-2007-2353 Apache Axis allows Exposure of Sensitive Information to an Unauthorized Actor
MediumCVSS 5.0
EPSS 27.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installation path in the resulting exception message.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache axis | = 1.0 | No fix listed |
| org.apache.axis/axis(Maven) | < 1.2 | 1.2 |
| debian/axis(Debian:12) | All versions | No fix listed |
| debian/axis(Debian:12) | = 1.4-28 | No fix listed |
| debian/axis(Debian:12) | = 1.4-28+deb12u1 | No fix listed |
| debian/axis(Debian:12) | = 1.4-29 | No fix listed |
| debian/axis(Debian:12) | = 1.4-30 | No fix listed |
| debian/axis(Debian:13) | All versions | No fix listed |
| debian/axis(Debian:13) | = 1.4-29 | No fix listed |
| debian/axis(Debian:13) | = 1.4-30 | No fix listed |
| debian/axis(Debian:14) | All versions | No fix listed |
| debian/axis(Debian:14) | = 1.4-29 | No fix listed |
| debian/axis(Debian:14) | = 1.4-30 | No fix listed |
References
- Debian Security Tracker CVE-2007-2353 vendor-advisory
- 20070427 Apache AXIS Non-Existent Java Web Service Path Disclosure? mailing-list
- 34154 vdb-entry
- 23687 exploit vdb-entry
- apache-axis-wsdl-path-disclosure(34167) vdb-entry
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com
- github.com patch
- github.com patch
- github.com patch
- github.com product
- github.com