Unscored severity · published Apr 30, 2007
CVE-2007-2353
Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installation path in the resulting exception…
–
CVSS
27.7%
EPSS
No
On KEV
Description
Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installation path in the resulting exception message.
Exploitation
Is it being used?
Exploit prediction (EPSS)27.7% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AX
Axis · Apache
1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-2353
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-2353
attrition.org
http://attrition.org/pipermail/vim/2007-April/001562.html
www.osvdb.org
http://www.osvdb.org/34154
Exploit
http://www.securityfocus.com/bid/23687
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/34167
More from Axis
9.8
CVE-2023-40743
** UNSUPPORTED WHEN ASSIGNED ** When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through "ServiceFactory.getService"…
7.5
CVE-2019-0227
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006
7.2
CVE-2023-51441
** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Axis allowed users with access to the admin service to perform possible SSRF This issue affects…
6.1
CVE-2018-8032
Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services
–
CVE-2014-3596
The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field…