CVE-2010-0219
Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2...
- Published
- Oct 18, 2010
- Updated
- Aug 7, 2024
- Assigning CNA
- certcc
- Evidence observed
- Dec 14, 2010
Primary CVSS
nvd · CVSS 2.0
AV:N/AC:L/Au:N/C:C/I:C/A:CHigh · next 30 days
- Percentile
- 99.8%
- Model date
- Oct 15, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service.
Sources
modules/auxiliary/scanner/http/axis_login.rb
Metasploit Framework modulesDeclared conditions
- verification: check_not_declared($.auxiliary_scanner/http/axis_login.check)
- Apache Axis2 Default LoginTemplate
http/cves/2010/CVE-2010-0219.yaml
Nuclei TemplatesDeclared conditions
- network: http($.protocol_keys)
- verification: status,word($.matchers[*].type)
modules/exploits/multi/http/axis2_deployer.rb
Metasploit Framework modulesDeclared conditions
- platform: Java,Linux,Windows($.exploit_multi/http/axis2_deployer.platform)
- verification: check_not_declared($.exploit_multi/http/axis2_deployer.check)
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.