CVE-2010-2103

Apache Axis2 < 1.6.0 - XSS

Title source: rule

Description

Cross-site scripting (XSS) vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.1, 1.5.1, and possibly other versions, as used in SAP Business Objects 12, 3com IMC, and possibly other products, allows remote attackers to inject arbitrary web script or HTML via the modules parameter. NOTE: some of these details are obtained from third party information.

Exploits (1)

exploitdb WORKING POC

by Richard Brain · textwebappsmultiple

https://www.exploit-db.com/exploits/12689

View Code ZIP pw:eip

References (10)

[Exploit] http://osvdb.org/64844

[Vendor Advisory] http://secunia.com/advisories/39906

[Various Sources] http://spl0it.org/files/talks/source_barcelona10/Hacking%20SAP%20BusinessObjects.pdf

[Exploit] http://www.exploit-db.com/exploits/12689

[Exploit] http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-03

[Exploit] http://www.securityfocus.com/bid/40327

[Vendor Advisory] http://www.vupen.com/english/advisories/2010/1215

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/58790

[Vendor Advisory] https://kb.juniper.net/KB27373

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/511404/100/0/threaded

Scores

EPSS 0.2177

EPSS Percentile 95.7%

Classification

CWE

CWE-79

Status published

Affected Products (4)

apache/axis2

apache/axis2

org.apache.axis2.wso2/axis2 < 1.6.0Maven

n/a/n/a

Timeline

Published May 27, 2010

Tracked Since Feb 18, 2026