The exposeServiceMetadata service parameter is enforced only on ?wsdl, ?wsdl2 and ?xsd queries, allowing forced browsing of .wsdl and .xsd routes in Apache Axis2/Java before 2.0.2.
Apache Axis2/Java before 2.0.2 allows SSRF when building service descriptions from WSDL through unrestricted fetching of absolute URLs in wsdl:import and xsd:import/include locations.
Apache Axis2/Java JSON builders buffered full request bodies without limits, enabling unauthenticated memory exhaustion, fixed in 2.0.2.
The multipart/form-data and application/x-www-form-urlencoded builders have no size limit
The Swagger UI page writes the Host header into the page without encoding
An unauthenticated caller could supply a non-anonymous WS-Addressing address
The XML External Entity (XXE) injection vulnerability in Apache Axis2/Java allows attackers to inject external entities when clients import WSDL/XSD documents via wsdl4j.
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.
Today 1.5K readers · 2.4K views · 757 reads · all time 189K views