Threats tagged 'ghsa-f58r-c62m-574f'

Apache Axis2/Java versions through 2.0.1 have a Direct Request ('Forced Browsing') vulnerability where service metadata is exposed through multiple endpoints despite the exposeServiceMetadata parameter being disabled for certain queries. This allows anonymous callers to access metadata including operation names and request/response schemas. The issue is fixed in version 2.0.2.