CVE-2010-0219: apache axis2 Credentials Management Errors
Vulnerability summary
CVE-2010-0219 is a high (CVSS 10.0) Credentials Management Errors vulnerability in apache axis2. EPSS estimates a 90.85% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 7 public exploits are recorded.
Timeline
- 18-10-2010PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
90.85%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 90.85% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
7 foundExploit Reference (spl0it.org)
Maturity: unknown
Exploit Reference (rapid7.com)
Maturity: unknown
Axis2 - (Authenticated) Code Execution (via REST) (Metasploit)
Maturity: weaponized
Show all 7 exploits
Axis2 / SAP BusinessObjects - (Authenticated) Code Execution (via SOAP) (Metasploit)
Maturity: weaponized
CA ARCserve D2D r15 - Web Service Servlet Code Execution
Maturity: weaponized
Apache Axis2 Brute Force Utility
auxiliary/scanner/http/axis_login
Maturity: poc
Axis2 / SAP BusinessObjects Authenticated Code Execution (via SOAP)
exploit/multi/http/axis2_deployer
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Apache1 product
- axis21.3 | 1.4 | 1.4.1 | 1.5 | 1.5.1 | 1.5.2 | 1.6
Sap1 product
2 vendors · 2 products
References
14 links- kb.juniper.net/KB27373X Refsource CONFIRM
- retrogod.altervista.org/9sg_ca_d2d.htmlX Refsource MISC
- spl0it.org/files/talks/source_barcelona10/Hacking%20SAP%20BusinessObjects.pdfX Refsource MISCExploit