Metadata disclosure in Apache Axis2/Java before 2.0.2
exposeServiceMetadata is not enforced on all metadata routes in Apache Axis2/Java. Anonymous callers can request packaged .wsdl .xsd, named-WSDL, OpenAPI, Swagger UI and WS-MetadataExchange endpoints, exposing operation names and schemas. Affects Apache Axis2/Java through 2.0.1.
What to do: Upgrade to Apache Axis2/Java 2.0.2.
| Product | Affected | Fixed in |
|---|---|---|
| Apache Axis2/Java | through 2.0.1 | 2.0.2 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Direct Request ('Forced Browsing') vulnerability in Apache Axis2/Java. The exposeServiceMetadata service parameter was enforced only on the ?wsdl, ?wsdl2 and ?xsd queries. For a service that had disabled it, the packaged .wsdl and .xsd file routes, the named-WSDL ?wsdl=NAME route of the standalone HTTP server, the OpenAPI, Swagger UI and MCP catalog endpoints, the services listing, WS-MetadataExchange GetMetadata and the ping module still disclosed its metadata to anonymous callers, including operation names and request and response schemas. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
The exposeServiceMetadata service parameter is enforced only on ?wsdl, ?wsdl2 and ?xsd queries, allowing forced browsing of .wsdl and .xsd routes in Apache Axis2/Java before 2.0.2.
Today 1.6K readers · 2.4K views · 774 reads · all time 189K views