vulnwire
5.3med

CVE-2007-23531 exploit

Apache Axis allows Exposure of Sensitive Information to an Unauthorized Actor

Also known as GHSA-2c4w-2px5-9x3x

Published 19 y ago · modified 4 mo ago · JSON

CVSS
5.3
v3.1 · GitHub
CISA KEV
No
not known exploited
EPSS
27.7%
percentile 98%
Public exploits
1
Exploit-DB

Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installation path in the resulting exception message.

Exploit prediction (EPSS)

27.65% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.

Exploits and detections

  • EDB-29930 Apache AXIS 1.0 - Non-Existent WSDL Path Information Disclosure · remote · 2007-04-27

CVSS scores

Assigned byVersionScoreVector
NVD2.05.0AV:N/AC:L/Au:N/C:P/I:N/A:N
GitHub3.15.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.axis:axis
<1.2
1.2

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

  • osvdb.org /34154 · vdb-entry, x_refsource_OSVDB, x_transferred
  • securityfocus.com /bid/23687 · vdb-entry, x_refsource_BID, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/34167 · vdb-entry, x_refsource_XF, x_transferred
  • attrition.org /pipermail/vim/2007-April/001562.html · mailing-list, x_refsource_VIM, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2007-2353 · advisory
  • github.com /albfernandez/axis1-java/issues/34#issuecomment-1006693110 · web
  • github.com /albfernandez/axis1-java/commit/32f35038ecae2c7a7f2e904b2289fd383f6f4d1f · web
  • github.com /apache/axis-axis1-java/commit/2fdbb91c5e861e804db70cada188b1d7c1603513 · web
  • github.com /apache/axis-axis1-java/commit/7ba89deb2eb21615630f18e96a35bfdec7f7cfed · web
  • github.com /apache/axis-axis1-java · package

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.