DescribeVulnerability

该API可以查看漏洞描述，分类，漏洞证明，造成影响，解决建议等详情。

请求参数

返回数据

示例

请求示例

http(s)://[Endpoint]/?Action=DescribeVulnerability
&Id=11369052
&SourceIp=1.2.3.4
&<公共请求参数>

正常返回示例

XML 格式

<DescribeVulnerability>
      <Vulnerability>
		    <Impact>对集群服务造成信息泄露或拒绝服务威胁。</Impact>
		    <Status>0</Status>
		    <Args>{"host": "1.2.3.4", "port": 2181, "qps": 1}</Args>
		    <Description>ZooKeeper 是一个开放源码的分布式应用程序协调服务，提供的功能包括:配置维护、名字服务、分布式同步、组服务等。Zookeeper默认是未授权就可以访问，
特别对于公网开放的 Zookeeper 来说，这也导致了信息泄露的存在，具有潜在高风险。</Description>
		    <Poc>
			漏洞地址：1.2.3.4 端口：2181
			返回内容:
			&lt;pre&gt;Environment:
			zookeeper.version=3.4.12-e5259e437540f349646870ea94dc2658c4e44b3b, built on 03/27/2018 03:55 GMT
			host.name=iZbp1fqhknu8ntff13g4m8Z
			java.version=1.8.0_181
			java.vendor=Oracle Corporation
			java.home=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.181-3.b13.el7_5.x86_64/jre
			java.class.path=/home/duwenwen/tools/zookeeper/bin/../build/classes:/home/duwenwen/tools/zookeeper/bin/../build/lib/*.jar:/home/duwenwen/tools/zookeeper/bin/../lib/slf4j-log4j12-1.7.25.jar:/home/duwenwen/tools/zookeeper/bin/../&lt;/pre&gt;
		</Poc>
		    <LastDiscoveredAt>1546504134000</LastDiscoveredAt>
		    <Owasp>OWASP A5 失效的访问控制</Owasp>
		    <Reference></Reference>
		    <Hostname>1.2.3.4</Hostname>
		    <CommonType>失效的访问控制</CommonType>
		    <Data>{"host": "1.2.3.4", "port": 2181, "proof": "Environment:\nzookeeper.version=3.4.12-e5259e437540f349646870ea94dc2658c4e44b3b, built on 03/27/2018 03:55 GMT\nhost.name=iZbp1fqhknu8ntff13g4m8Z\njava.version=1.8.0_181\njava.vendor=Oracle Corporation\njava.home=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.181-3.b13.el7_5.x86_64/jre\njava.class.path=/home/duwenwen/tools/zookeeper/bin/../build/classes:/home/duwenwen/tools/zookeeper/bin/../build/lib/*.jar:/home/duwenwen/tools/zookeeper/bin/../lib/slf4j-log4j12-1.7.25.jar:/home/duwenwen/tools/zookeeper/bin/../"}</Data>
		    <Severity>3</Severity>
		    <Name>ZooKeeper 未授权访问</Name>
		    <Cwe>CWE-284</Cwe>
		    <Target>1.2.3.4</Target>
		    <Wasc>WASC-2</Wasc>
		    <Id>11507253</Id>
		    <Solution>1、禁止把Zookeeper直接暴露在公网
2、添加访问控制，根据情况选择对应方式（认证用户，用户名密码，指定IP）</Solution>
	  </Vulnerability>
	  <code>200</code>
	  <Success>true</Success>
	  <RequestId>6AAFCBCE-3494-4BF4-AA20-CD4BE491D22B</RequestId>
</DescribeVulnerability>

JSON 格式

{
	"RequestId":"6AAFCBCE-3494-4BF4-AA20-CD4BE491D22B",
	"code":200,
	"Vulnerability":{
		"Impact":"对集群服务造成信息泄露或拒绝服务威胁。",
		"Poc":"\r\n漏洞地址：1.2.3.4 端口：2181\r\n返回内容:\r\n<pre>Environment:\nzookeeper.version=3.4.12-e5259e437540f349646870ea94dc2658c4e44b3b, built on 03/27/2018 03:55 GMT\nhost.name=iZbp1fqhknu8ntff13g4m8Z\njava.version=1.8.0_181\njava.vendor=Oracle Corporation\njava.home=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.181-3.b13.el7_5.x86_64/jre\njava.class.path=/home/duwenwen/tools/zookeeper/bin/../build/classes:/home/duwenwen/tools/zookeeper/bin/../build/lib/*.jar:/home/duwenwen/tools/zookeeper/bin/../lib/slf4j-log4j12-1.7.25.jar:/home/duwenwen/tools/zookeeper/bin/../</pre>\r\n",
		"Wasc":"WASC-2",
		"Description":"ZooKeeper 是一个开放源码的分布式应用程序协调服务，提供的功能包括:配置维护、名字服务、分布式同步、组服务等。Zookeeper默认是未授权就可以访问，\r\n特别对于公网开放的 Zookeeper 来说，这也导致了信息泄露的存在，具有潜在高风险。",
		"Owasp":"OWASP A5 失效的访问控制",
		"LastDiscoveredAt":1546504134000,
		"CommonType":"失效的访问控制",
		"Name":"ZooKeeper 未授权访问",
		"Cwe":"CWE-284",
		"Status":0,
		"Data":"{\"host\": \"1.2.3.4\", \"port\": 2181, \"proof\": \"Environment:\\nzookeeper.version=3.4.12-e5259e437540f349646870ea94dc2658c4e44b3b, built on 03/27/2018 03:55 GMT\\nhost.name=iZbp1fqhknu8ntff13g4m8Z\\njava.version=1.8.0_181\\njava.vendor=Oracle Corporation\\njava.home=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.181-3.b13.el7_5.x86_64/jre\\njava.class.path=/home/duwenwen/tools/zookeeper/bin/../build/classes:/home/duwenwen/tools/zookeeper/bin/../build/lib/*.jar:/home/duwenwen/tools/zookeeper/bin/../lib/slf4j-log4j12-1.7.25.jar:/home/duwenwen/tools/zookeeper/bin/../\"}",
		"Args":"{\"host\": \"1.2.3.4\", \"port\": 2181, \"qps\": 1}",
		"Target":"1.2.3.4",
		"Severity":3,
		"Id":11507253,
		"Reference":"",
		"Solution":"1、禁止把Zookeeper直接暴露在公网\r\n2、添加访问控制，根据情况选择对应方式（认证用户，用户名密码，指定IP）",
		"Hostname":"1.2.3.4"
	},
	"Success":true
}

错误码

访问错误中心查看更多错误码。