Apache Axis allows Exposure of Sensitive Information to an Unauthorized Actor

MEDIUM 5.0CVE-2007-2353 · GHSA-2c4w-2px5-9x3x · Published 30/04/2007 · updated 16/06/2026

Package	Affected versions	Patched versions
org.apache.axis:axis Maven	`< 1.2`	`1.2`
axis apache	`= 1.0`	No fix yet

Description

Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installation path in the resulting exception message.

NVD description

Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installation path in the resulting exception message.

References

nvd.nist.gov/vuln/detail/CVE-2007-2353 · ADVISORY
albfernandez/axis1-java · WEB
albfernandez/axis1-java commit 32f3503 · WEB
apache/axis-axis1-java commit 2fdbb91 · WEB
apache/axis-axis1-java commit 7ba89de · WEB
exchange.xforce.ibmcloud.com/vulnerabilities/34167 · WEB
apache/axis-axis1-java · PACKAGE
attrition.org/pipermail/vim/2007-April/001562.html · WEB
osvdb.org/34154
securityfocus.com/bid/23687 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free