CVE-2010-1632
- State
- Published
- Severity
- Not scored
- Published
- Jun 22, 2010
- Updated
- Aug 7, 2024
- Reserved
- Apr 29, 2010
Description
Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server (WAS) 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to the Synapse SimpleStockQuoteService.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- http://markmail.org/message/e4yiij7lfexastvl
- http://geronimo.apache.org/2010/07/21/apache-geronimo-v216-released.html
- PM14844vendor-advisory
- ADV-2010-1528vdb-entry
- PM14765vendor-advisory
- ADV-2010-1531vdb-entry
- http://www-01.ibm.com/support/docview.wss?uid=swg21433581
- PM14847vendor-advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289984
- 41025third-party-advisory
- http://geronimo.apache.org/22x-security-report.html
- 1036901vdb-entry
- https://issues.apache.org/jira/browse/AXIS2-4450
- 41016third-party-advisory
- https://svn.apache.org/repos/asf/axis/axis2/java/core/security/CVE-2010-1632.pdf
- 40279third-party-advisory
- https://issues.apache.org/jira/browse/GERONIMO-5383
- 40252third-party-advisory
- http://geronimo.apache.org/21x-security-report.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.