CVE-2007-2353 Apache Axis allows Exposure of Sensitive Information to an Unauthorized Actor
Remote attackers can obtain sensitive installation path information by requesting a non-existent WSDL file in Apache Axis.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2007-2353?
CVE-2007-2353 is a medium-severity vulnerability in n/a, published on 30 Apr 2007. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installation path in the resulting exception message.
Weakness: CWE-200
Which versions are affected by CVE-2007-2353?
2 open source packages ship an affected version, including org.apache.axis:axis. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.axis:axis Maven | All versions | 1.2 |
org.apache.axis:axis Maven | All versions | 1.2 |
Products include Apache Axis.
How do I fix CVE-2007-2353?
Upgrade org.apache.axis:axis to 1.2 or later.
Is CVE-2007-2353 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2007-2353 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
- CVE-2023-40743 Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getService
- CVE-2019-0227 Server Side Request Forgery in Apache Axis
- CVE-2023-51441 Apache Axis 1.x (EOL) may allow SSRF when untrusted input is passed to the service admin HTTP API
- CVE-2018-8032 Moderate severity vulnerability that affects apache axis
- CVE-2014-3596 Improper Validation of Certificates in apache axis
Sources
Also known as DEBIAN-CVE-2007-2353, GHSA-2c4w-2px5-9x3x.