Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2010-0219

Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service.

Published

2010-10-18T17:00:03.457

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 10.0 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: COMPLETE
Integrity Impact: COMPLETE
Availability Impact: COMPLETE

Exploitability Score

10.0

Impact Score

10.0

Weaknesses

Type: Primary
CWE-255

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	apache	axis2	1.3	Yes
Application	apache	axis2	1.4	Yes
Application	apache	axis2	1.4.1	Yes
Application	apache	axis2	1.5	Yes
Application	apache	axis2	1.5.1	Yes
Application	apache	axis2	1.5.2	Yes
Application	apache	axis2	1.6	Yes
Application	sap	businessobjects	3.2	Yes

References

http://retrogod.altervista.org/9sg_ca_d2d.html ([email protected])
http://secunia.com/advisories/41799 Vendor Advisory ([email protected])
http://secunia.com/advisories/42763 ([email protected])
http://spl0it.org/files/talks/source_barcelona10/Hacking%20SAP%20BusinessObjects.pdf Exploit ([email protected])
http://www.exploit-db.com/exploits/15869 ([email protected])
http://www.kb.cert.org/vuls/id/989719 US Government Resource ([email protected])
http://www.osvdb.org/70233 ([email protected])
http://www.rapid7.com/security-center/advisories/R7-0037.jsp Exploit ([email protected])
http://www.securityfocus.com/archive/1/514284/100/0/threaded ([email protected])
http://www.securitytracker.com/id?1024929 ([email protected])
http://www.vupen.com/english/advisories/2010/2673 Vendor Advisory ([email protected])
https://exchange.xforce.ibmcloud.com/vulnerabilities/62523 ([email protected])
https://kb.juniper.net/KB27373 ([email protected])
https://service.sap.com/sap/support/notes/1432881 Patch ([email protected])
http://retrogod.altervista.org/9sg_ca_d2d.html (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/41799 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/42763 (af854a3a-2127-422b-91ae-364da2661108)
http://spl0it.org/files/talks/source_barcelona10/Hacking%20SAP%20BusinessObjects.pdf Exploit (af854a3a-2127-422b-91ae-364da2661108)
http://www.exploit-db.com/exploits/15869 (af854a3a-2127-422b-91ae-364da2661108)
http://www.kb.cert.org/vuls/id/989719 US Government Resource (af854a3a-2127-422b-91ae-364da2661108)
http://www.osvdb.org/70233 (af854a3a-2127-422b-91ae-364da2661108)
http://www.rapid7.com/security-center/advisories/R7-0037.jsp Exploit (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/514284/100/0/threaded (af854a3a-2127-422b-91ae-364da2661108)
http://www.securitytracker.com/id?1024929 (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2010/2673 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://exchange.xforce.ibmcloud.com/vulnerabilities/62523 (af854a3a-2127-422b-91ae-364da2661108)
https://kb.juniper.net/KB27373 (af854a3a-2127-422b-91ae-364da2661108)
https://service.sap.com/sap/support/notes/1432881 Patch (af854a3a-2127-422b-91ae-364da2661108)