CVE-2010-0219
Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service.
- Affected products
- Apache Axis2
- Apache axis2
- = 1.3, 1.4, 1.4.1, 1.5, 1.5.1, 1.5.2, 1.6
- Sap Businessobjects
- = 3.2
- CVSS 2.0
- 10.0 HIGH
- EPSS
- 89.9% (100th percentile)
- Weakness
- CWE-255
- NVD status
- Modified
- Published
- 2010-10-18
CVE-2010-0219 at NVD
17 known exploits for CVE-2010-0219
Proof-of-concept code and exploit modules indexed by Sploitus
Apache Axis2 Brute Force Utility
Apache Axis2 Brute Force Utility
HP Universal CMDB Server Axis2 default password
HP Universal CMDB Server Axis2 default password
HP Universal CMDB Server Axis2 default password
HP Universal CMDB Server Axis2 default password
CA ARCserve D2D Axis2 default password
CA ARCserve D2D Axis2 default password
CA ARCserve D2D Axis2 default password
CA ARCserve D2D Axis2 default password
CA ARCserve D2D r15 - Web Service Servlet Code Execution
Axis2 / SAP BusinessObjects Authenticated Code Execution (via SOAP)
Axis2 - (Authenticated) Code Execution (via REST) (Metasploit)
Axis2 / SAP BusinessObjects - (Authenticated) Code Execution (via SOAP) (Metasploit)
Axis2 Upload Exec (via REST)
Axis2 / SAP BusinessObjects dswsbobje Upload Exec
Rapid7 Security Advisory 37