Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Apache Axis2/Java Administration Console Allows Malicious Script Injection

CVE-2010-2103 · published 16 years ago
Summary

A security flaw in the administration console of Apache Axis2/Java allows an attacker to inject malicious code into the system. This could potentially allow an attacker to take control of the system or steal sensitive information. If you use Apache Axis2/Java, especially in conjunction with SAP Business Objects or 3com IMC, you should update to a patched version.

What to do
  • Update apache org.apache.axis2.wso2:axis2 to version 1.6.0.
Affected software
Ecosystem VendorProductAffected versions
maven apache org.apache.axis2.wso2:axis2 >= 1.4.1, < 1.6.0
Fix: upgrade to 1.6.0
– apache axis2 1.4.1
1.5.1
cpe:2.3:a:apache:axis2:1.4.1:*:*:*:*:*:*:*
Original advisory text
Cross-site scripting (XSS) vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.1, 1.5.1, and possibly other versions, as used in SAP Bus...
Cross-site scripting (XSS) vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.1, 1.5.1, and possibly other versions, as used in SAP Business Objects 12, 3com IMC, and possibly other products, allows remote attackers to inject arbitrary web script or HTML via the modules parameter. NOTE: some of these details are obtained from third party information.
References
Severity
4.3 Medium
Exploitation
35% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published27 May 2010
Updated23 Aug 2026
First seen6 Mar 2026
Sources
GHSA-23x8-j7hm-5xwf · GHSA
CVE-2010-2103 · NVD
Track software like this
Free during beta