PT-2007-3686 · Apache+1 · Apache Axis+1

Curmudgeonjericho · Published 2007-04-30 · Updated 2022-05-01 · CVE-2007-2353

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Axis version 1.0

Description The issue allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file. This action reveals the installation path in the resulting exception message.

Recommendations For Apache Axis version 1.0, consider restricting access to the WSDL files to minimize the risk of exploitation. As a temporary workaround, modify the error handling mechanism to avoid disclosing sensitive information, such as the installation path, in exception messages.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2007-2353

GHSA-2C4W-2PX5-9X3X

Affected Products

Apache Axis

Debian

References · 15

• 🔥 https://exploit-db.com/exploits/29930 · Exploit
• 🔥 http://securityfocus.com/bid/23687 · Exploit
• https://osv.dev/vulnerability/GHSA-2c4w-2px5-9x3x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2353 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2007-2353 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-2353 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-2353 · Vendor Advisory
• https://github.com/apache/axis-axis1-java/commit/7ba89deb2eb21615630f18e96a35bfdec7f7cfed · Note
• https://github.com/apache/axis-axis1-java/commit/2fdbb91c5e861e804db70cada188b1d7c1603513 · Note
• https://github.com/apache/axis-axis1-java · Note
• https://github.com/albfernandez/axis1-java/commit/32f35038ecae2c7a7f2e904b2289fd383f6f4d1f · Note
• https://github.com/albfernandez/axis1-java/issues/34#issuecomment-1006693110 · Note
• http://osvdb.org/34154 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34167 · Note
• http://attrition.org/pipermail/vim/2007-April/001562.html · Note