Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server (WAS) 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to the Synapse SimpleStockQuoteService.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Apache Axis2文档类型声明处理多个安全漏洞
Vulnerability Description
Axis2是一个Web服务的核心支援引擎。 根据SOAP 1.1规范的规定，SOAP消息总不能包含有文档类型声明(DTD)。在Axis2中，是通过StAXSOAPModelBuilder类来实现这个限制的。这个方法存在两个问题： 1 仅适用于SOAP绑定，而支持纯XML消息的HTTP绑定仍允许请求消息中存在DTD。 2 在处理带有DTD的文档时，StAXSOAPModelBuilder仅在从StAX解析器接收到DTD事件后才会报告错误，而这时StAX解析器可能已经处理或部分处理了DTD。 这说明Axis2
CVSS Information
N/A
Vulnerability Type
N/A