Axis system configuration listing enabled in WEB-INF/server-config.wsdd
Severity:
Medium
Summary
Invicti detected that the web application has enabled listing of the Web Service Deployment Descriptor (WSDD). This feature exposes the current system configuration which contains sensitive information like the adminservice password.
It's recommended to modify the configuration file WEB-INF/server-config.wsdd to disable configuration listing.
Impact
When Axis system configuration listing is enabled, sensitive information like the adminservice password is leaked to attackers.
Remediation
Required Skills for Successful Exploitation
Actions To Take
In the example below, the web application disable listing of the Web Service Deployment Descriptor (WSDD):
<globalConfiguration>
<parameter name="axis.enableListQuery" value="false"/>
</globalConfiguration>
Classifications
Vulnerability Index
You can search and find all vulnerabilities
Select Category
Select Vulnerability
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Build your resistance to threats. And save hundreds of hours each month.
