Description

Apache Axis2 installation includes a JSP page accessible at axis2-web/HappyAxis.jsp that discloses a lot of sensitive information. An attacker could use this information to conduct further attacks.

Remediation

If you don't want this information to be publicly accessible you need to restrict access to the /axis2-web/ directory.

References

Apache Axis2 Web Administrator's Guide

Related Vulnerabilities

Cloud metadata publicly exposed

WordPress Plugin RB Agency Local File Disclosure (2.4.7)

Possible sensitive directories

WordPress 6.2.x Multiple Vulnerabilities (6.2 - 6.2.2)

WordPress 4.8.x Multiple Vulnerabilities (4.8 - 4.8.7)

Severity

Medium

Classification

CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Information Disclosure