Apache Axis2 "xsd" XML Local File Inclusion Vulnerability
Description
(:A local file inclusion vulnerability has been identified in Apache Axis2, impacting other products such as IBM WebSphere Application Server. A remote attacker can exploit it to read arbitrary files on the web server, including the file containing the username and password in cleartext, and logon with administrative privileges.::An exploitation code is available in the Metasploit framework.::The "xsd" parameter of the "/axis2/services/Version" and "/InsaneService/services/WSInsane" scripts can load XML content from an arbitrary location, including "/WEB-INF/conf/axis2.xml".)
