1248
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Technology : Web Server (Prevalence = Often)
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
The attacker may find sensitive information located in the
WSDL file.
Potential Mitigations
Phase: Architecture and Design
Limit access to the WSDL file as much as possible. If services are provided only to a limited
number of entities, it may be better to provide WSDL privately to each of these entities than to
publish WSDL publicly.
Phase: Architecture and Design
Strategy = Separation of Privilege
Make sure that WSDL does not describe methods that should not be publicly accessible. Make
sure to protect service methods that should not be publicly accessible with access controls.
Phase: Architecture and Design
Do not use method names in WSDL that might help an adversary guess names of private
methods/resources used by the service.
CWE Version 4.14
CWE-652: Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')
CWE-652: Improper Neutralization of Data
within XQuery Expressions ('XQuery Injection')