CVE-2010-0219

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 90.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2010-10-18 · updated 2026-06-16
Weakness: CWE-255

Description

Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service.

Affected products

Apache Axis2: 1.3, 1.4, 1.4.1, 1.5, 1.5.1, 1.5.2 (+1)
SAP_SE SAP BusinessObjects Business Intelligence Platform (Central Management Server): 3.2

References

http://retrogod.altervista.org/9sg_ca_d2d.html
http://secunia.com/advisories/41799
http://secunia.com/advisories/42763
http://spl0it.org/files/talks/source_barcelona10/Hacking%20SAP%20BusinessObjects.pdf
http://www.exploit-db.com/exploits/15869
http://www.kb.cert.org/vuls/id/989719
http://www.osvdb.org/70233
http://www.rapid7.com/security-center/advisories/R7-0037.jsp
http://www.securityfocus.com/archive/1/514284/100/0/threaded
http://www.securitytracker.com/id?1024929
http://www.vupen.com/english/advisories/2010/2673
https://exchange.xforce.ibmcloud.com/vulnerabilities/62523

Get alerted when CVE-2010-0219 or the next vulnerability affects your stack