CVE-2010-0219 Hardcoded credentials in n/a
Remote attackers can execute arbitrary code by exploiting a default admin password in Apache Axis2 to upload malicious web services.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2010-0219?
CVE-2010-0219 is a critical vulnerability in n/a, published on 18 Oct 2010. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service.
Weakness: CWE-255
Which versions are affected by CVE-2010-0219?
It affects 2 products.
Products include Apache Axis2, Sap Businessobjects.
How do I fix CVE-2010-0219?
No fix has been published for CVE-2010-0219 yet. Limit exposure of the affected software until one is available.
Is CVE-2010-0219 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2010-0219 exists.
Public exploit code: 2 Metasploit modules, 3 Exploit-DB entries, 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
- CVE-2010-1632 Improper Input Validation in Apache Axis2
- CVE-2012-5351 Improper Authentication in Apache Axis2
- CVE-2012-5785 Apache Axis2 has Improper Input Validation
- CVE-2012-4418 Apache Axis2 Vulnerable to XML Signature wrapping attack
- CVE-2010-2103 Improper Neutralization of Input During Web Page Generation in Apache Axis2
Sources
Also known as GHSA-9x38-862g-jg8w.