CVE-2007-2353
Apache Axis allows Exposure of Sensitive Information to an Unauthorized Actor
CVE-2007-2353 is a medium vulnerability (CVSS 5.0) in Apache Axis, published April 30, 2007. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 27.7%, the 98th percentile. Fixed in org.apache.axis:axis 1.2.
Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installation path in the resulting exception message.
Exploit likelihood
What each source reports
NVD Score used
Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installation path in the resulting exception message.
- Record
CVE-2007-2353- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installation path in the resulting exception message.
- Record
CVE-2007-2353- Updated
- 2026-11-02
EUVDEUVD-2007-2348 No score
Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installation path in the resulting exception message.
- Record
EUVD-2007-2348- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2c4w-2px5-9x3x
Apache Axis allows Exposure of Sensitive Information to an Unauthorized Actor
Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installation path in the resulting exception message.
- Record
GHSA-2c4w-2px5-9x3x- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-2c4w-2px5-9x3x
Apache Axis allows Exposure of Sensitive Information to an Unauthorized Actor
Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installation path in the resulting exception message.
- Record
GHSA-2c4w-2px5-9x3x- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV No score
Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installation path in the resulting exception message.
- Record
CVE-2007-2353- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-2353 No score
Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installation path in the resulting exception message.
- Record
DEBIAN-CVE-2007-2353- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.axis:axisMaven |
before 1.2 | 1.2 |
axisDebian:12 |
All versions, plus listed versions 1.4-281.4-28+deb12u11.4-291.4-30 |
None known |
axisDebian:13 |
All versions, plus listed versions 1.4-291.4-30 |
None known |
axisDebian:14 |
All versions, plus listed versions 1.4-291.4-30 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Apache AXIS 1.0 - Non-Existent WSDL Path Information Disclosure | 2007-04-27 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | affected, aliases, exploits, facts, references, title | Exploit-DB, GitHub Advisories, OSV |
| 2026-11-02 | created | CVE List, NVD |
References
osvdb.org/34154
securityfocus.com/bid/23687
exchange.xforce.ibmcloud.com/vulnerabilities/34167
attrition.org/pipermail/vim/2007-April/001562.html
nvd.nist.gov/vuln/detail/CVE-2007-2353
github.com/albfernandez/axis1-java/issues/34
Show 6 moreShow less
security-tracker.debian.org/tracker/CVE-2007-2353