{
  "Name": "Apache Axis2 1.4.1 Remote Directory Traversal Vulnerability (CVE-2010-0219)",
  "Description": "Apache Axis2 is prone to a directory traversal vulnerability because it fails to sufficiently sanitize user-supplied input via the xsd parameter in activated services. Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks. Refer to AXIS2-4279 to obtain additional details about this vulnerability.",
  "Product": "Apache-Axis2",
  "Homepage": "https://axis.apache.org/",
  "DisclosureDate": "2020-04-23",
  "Author": "gobysec@gmail.com",
  "FofaQuery": "app=\"Apache-Axis2\" || app=\"Axis2-Web\"",
  "GobyQuery": "app=\"Apache-Axis2\" || app=\"Axis2-Web\"",
  "Level": "3",
  "Impact": "Exploiting this issue could allow an attacker to obtain sensitive information, which could aid in further attacks.",
  "Recommendation": "The vendor has released fixes. Please see the references for more information.",
  "References": [
    "https://www.securityfocus.com/bid/40343",
	"https://www.exploit-db.com/exploits/12721",
	"https://nmap.org/nsedoc/scripts/http-axis2-dir-traversal.html"
  ],
  "HasExp": true,
  "ExpParams": [
            {
                  "name": "file",
                  "type": "createSelect",
                  "value": "../conf/axis2.xml,../../../../conf/tomcat-users.xml,../../../../../../../../etc/passwd"
            }
      ],
  "ExpTips": {
    "Type": "Tips",
    "Content": ""
  },
  "ScanSteps": null,
  "ExploitSteps": null,
  "Tags": [
    "lfi"
  ],
  "CVEIDs": [
    "CVE-2010-0219"
  ],
  "CVSSScore": null,
  "AttackSurfaces": {
    "Application": null,
    "Support": ["Apache-Axis2"],
    "Service": null,
    "System": null,
    "Hardware": null
  },
  "Disable": false
}