Skip to content

[GHSA-2c4w-2px5-9x3x] Apache Axis 1.0 allows remote attackers to obtain...#7203

Merged
advisory-database[bot] merged 1 commit intotal-sealsecurity/advisory-improvement-7203from
tal-sealsecurity-GHSA-2c4w-2px5-9x3x
Mar 20, 2026
Merged

[GHSA-2c4w-2px5-9x3x] Apache Axis 1.0 allows remote attackers to obtain...#7203
advisory-database[bot] merged 1 commit intotal-sealsecurity/advisory-improvement-7203from
tal-sealsecurity-GHSA-2c4w-2px5-9x3x

Conversation

@tal-sealsecurity
Copy link
Copy Markdown

@tal-sealsecurity tal-sealsecurity commented Mar 19, 2026

Updates

  • Affected products
  • Description
  • References
  • Source code location
  • Summary

Comments
Fix released with axis version 1.2 (May 4, 2005)
no affected ranges were given until now

tested https://archive.apache.org/dist/ws/axis/1_1/axis-1_1.zip and got a leak

# curl http://localhost:8080/axis/PhantomFile.jws\?wsdl
...
#  faultString: java.io.FileNotFoundException: /usr/local/tomcat/webapps/axis/PhantomFile.jws (No such file or directory) <- Leaked info

tested https://archive.apache.org/dist/ws/axis/1_2/axis-bin-1_2.zip and got no leak

# curl http://localhost:8080/axis/PhantomFile.jws\?wsdl
...
#  faultString: java.io.FileNotFoundException: /PhantomFile.jws  <- Relative, no leasked info
...

@github-actions github-actions Bot changed the base branch from main to tal-sealsecurity/advisory-improvement-7203 March 19, 2026 20:29
@advisory-database advisory-database Bot merged commit 160af92 into tal-sealsecurity/advisory-improvement-7203 Mar 20, 2026
4 checks passed
@advisory-database
Copy link
Copy Markdown
Contributor

Hi @tal-sealsecurity! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!

@advisory-database advisory-database Bot deleted the tal-sealsecurity-GHSA-2c4w-2px5-9x3x branch March 20, 2026 14:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant