PT-2007-3686 · Apache+1 · Apache Axis+1

Curmudgeonjericho · Publicado 2007-04-30 · Atualizado 2022-05-01 · CVE-2007-2353

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Axis version 1.0

Description The issue allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file. This action reveals the installation path in the resulting exception message.

Recommendations For Apache Axis version 1.0, consider restricting access to the WSDL files to minimize the risk of exploitation. As a temporary workaround, modify the error handling mechanism to avoid disclosing sensitive information, such as the installation path, in exception messages.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2007-2353

GHSA-2C4W-2PX5-9X3X

Produtos afetados

Apache Axis

Debian

Referências · 15

• 🔥 https://exploit-db.com/exploits/29930 · Exploit
• 🔥 http://securityfocus.com/bid/23687 · Exploit
• https://github.com/apache/axis-axis1-java/commit/7ba89deb2eb21615630f18e96a35bfdec7f7cfed · Nota
• https://github.com/apache/axis-axis1-java/commit/2fdbb91c5e861e804db70cada188b1d7c1603513 · Nota
• https://github.com/apache/axis-axis1-java · Nota
• https://github.com/albfernandez/axis1-java/commit/32f35038ecae2c7a7f2e904b2289fd383f6f4d1f · Nota
• https://github.com/albfernandez/axis1-java/issues/34#issuecomment-1006693110 · Nota
• https://osv.dev/vulnerability/GHSA-2c4w-2px5-9x3x · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-2353 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2007-2353 · Aviso do Fabricante
• http://osvdb.org/34154 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34167 · Nota
• https://osv.dev/vulnerability/CVE-2007-2353 · Aviso do Fabricante
• http://attrition.org/pipermail/vim/2007-April/001562.html · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-2353 · Aviso do Fabricante