Unscored severity · published May 27, 2010
CVE-2010-2103
Cross-site scripting (XSS) vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.1, 1.5.1, and possibly other versions,…
–
CVSS
34.9%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.1, 1.5.1, and possibly other versions, as used in SAP Business Objects 12, 3com IMC, and possibly other products, allows remote attackers to inject arbitrary web script or HTML via the modules parameter. NOTE: some of these details are obtained from third party information.
Exploitation
Is it being used?
Exploit prediction (EPSS)34.9% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AX
Axis2 · Apache
1.4.1; 1.5.1; 1.4.1; 1.5.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-2103
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-2103
Exploit
http://osvdb.org/64844
Vendor Advisory
http://secunia.com/advisories/39906
spl0it.org
http://spl0it.org/files/talks/source_barcelona10/Hacking%20SAP%20BusinessObjects.pdf
Exploit
http://www.exploit-db.com/exploits/12689
Exploit
http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-03
www.securityfocus.com
http://www.securityfocus.com/archive/1/511404/100/0/threaded
More from Axis2
–
CVE-2012-5785
Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509…
–
CVE-2012-5351
Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a…
–
CVE-2012-4418
Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."
–
CVE-2010-0219
Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account,…
–
CVE-2010-1632
Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server (WAS) 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for…