7.5

CVE-2010-1632

Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server (WAS) 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to the Synapse SimpleStockQuoteService.

Data is provided by the National Vulnerability Database (NVD)
Apache ≫ Axis2 Version <= 1.5.1
   Ibm ≫ Websphere Application Server Version7.0
   Ibm ≫ Websphere Application Server Version7.0.0.1
   Ibm ≫ Websphere Application Server Version7.0.0.2
   Ibm ≫ Websphere Application Server Version7.0.0.3
   Ibm ≫ Websphere Application Server Version7.0.0.4
   Ibm ≫ Websphere Application Server Version7.0.0.5
   Ibm ≫ Websphere Application Server Version7.0.0.6
   Ibm ≫ Websphere Application Server Version7.0.0.7
   Ibm ≫ Websphere Application Server Version7.0.0.8
   Ibm ≫ Websphere Application Server Version7.0.0.9
   Ibm ≫ Websphere Application Server Version7.0.0.10
   Ibm ≫ Websphere Application Server Version7.0.0.11
   Ibm ≫ Websphere Application Server Version7.0.0.12
Apache ≫ Axis2 Version1.3
   Ibm ≫ Websphere Application Server Version7.0
   Ibm ≫ Websphere Application Server Version7.0.0.1
   Ibm ≫ Websphere Application Server Version7.0.0.2
   Ibm ≫ Websphere Application Server Version7.0.0.3
   Ibm ≫ Websphere Application Server Version7.0.0.4
   Ibm ≫ Websphere Application Server Version7.0.0.5
   Ibm ≫ Websphere Application Server Version7.0.0.6
   Ibm ≫ Websphere Application Server Version7.0.0.7
   Ibm ≫ Websphere Application Server Version7.0.0.8
   Ibm ≫ Websphere Application Server Version7.0.0.9
   Ibm ≫ Websphere Application Server Version7.0.0.10
   Ibm ≫ Websphere Application Server Version7.0.0.11
   Ibm ≫ Websphere Application Server Version7.0.0.12
Apache ≫ Axis2 Version1.4
   Ibm ≫ Websphere Application Server Version7.0
   Ibm ≫ Websphere Application Server Version7.0.0.1
   Ibm ≫ Websphere Application Server Version7.0.0.2
   Ibm ≫ Websphere Application Server Version7.0.0.3
   Ibm ≫ Websphere Application Server Version7.0.0.4
   Ibm ≫ Websphere Application Server Version7.0.0.5
   Ibm ≫ Websphere Application Server Version7.0.0.6
   Ibm ≫ Websphere Application Server Version7.0.0.7
   Ibm ≫ Websphere Application Server Version7.0.0.8
   Ibm ≫ Websphere Application Server Version7.0.0.9
   Ibm ≫ Websphere Application Server Version7.0.0.10
   Ibm ≫ Websphere Application Server Version7.0.0.11
   Ibm ≫ Websphere Application Server Version7.0.0.12
Apache ≫ Axis2 Version1.4.1
   Ibm ≫ Websphere Application Server Version7.0
   Ibm ≫ Websphere Application Server Version7.0.0.1
   Ibm ≫ Websphere Application Server Version7.0.0.2
   Ibm ≫ Websphere Application Server Version7.0.0.3
   Ibm ≫ Websphere Application Server Version7.0.0.4
   Ibm ≫ Websphere Application Server Version7.0.0.5
   Ibm ≫ Websphere Application Server Version7.0.0.6
   Ibm ≫ Websphere Application Server Version7.0.0.7
   Ibm ≫ Websphere Application Server Version7.0.0.8
   Ibm ≫ Websphere Application Server Version7.0.0.9
   Ibm ≫ Websphere Application Server Version7.0.0.10
   Ibm ≫ Websphere Application Server Version7.0.0.11
   Ibm ≫ Websphere Application Server Version7.0.0.12
Apache ≫ Axis2 Version1.5
   Ibm ≫ Websphere Application Server Version7.0
   Ibm ≫ Websphere Application Server Version7.0.0.1
   Ibm ≫ Websphere Application Server Version7.0.0.2
   Ibm ≫ Websphere Application Server Version7.0.0.3
   Ibm ≫ Websphere Application Server Version7.0.0.4
   Ibm ≫ Websphere Application Server Version7.0.0.5
   Ibm ≫ Websphere Application Server Version7.0.0.6
   Ibm ≫ Websphere Application Server Version7.0.0.7
   Ibm ≫ Websphere Application Server Version7.0.0.8
   Ibm ≫ Websphere Application Server Version7.0.0.9
   Ibm ≫ Websphere Application Server Version7.0.0.10
   Ibm ≫ Websphere Application Server Version7.0.0.11
   Ibm ≫ Websphere Application Server Version7.0.0.12
Apache ≫ Axis2 Version <= 1.5.1
   Apache ≫ Geronimo
Apache ≫ Axis2 Version1.3
   Apache ≫ Geronimo
Apache ≫ Axis2 Version1.4
   Apache ≫ Geronimo
Apache ≫ Axis2 Version1.4.1
   Apache ≫ Geronimo
Apache ≫ Axis2 Version1.5
   Apache ≫ Geronimo
Apache ≫ Axis2 Version <= 1.5.1
Apache ≫ Axis2 Version1.4.1
Apache ≫ Axis2 Version <= 1.5.1
   Apache ≫ Synapse
Apache ≫ Axis2 Version1.3
   Apache ≫ Synapse
Apache ≫ Axis2 Version1.4
   Apache ≫ Synapse
Apache ≫ Axis2 Version1.4.1
   Apache ≫ Synapse
Apache ≫ Axis2 Version1.5
   Apache ≫ Synapse
Apache ≫ Axis2 Version <= 1.5.1
   Apache ≫ Tuscany
Apache ≫ Axis2 Version1.3
   Apache ≫ Tuscany
Apache ≫ Axis2 Version1.4
   Apache ≫ Tuscany
Apache ≫ Axis2 Version1.4.1
   Apache ≫ Tuscany
Apache ≫ Axis2 Version1.5
   Apache ≫ Tuscany
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 8.81% 0.922
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.