$ cve CVE-2010-0219 JSON

CVE-2010-0219 EXPLOIT

10.0

HIGH · CVSS 2.0 · EPSS 90.9% (pctl 100)

Patch early

A public exploit exists.

Description

Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service.

Scoring

CVSS	10.0 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS	90.85% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-255
On CISA KEV	no
Public exploit	yes
Published	2010-10-18
Last modified	2026-06-16

Affected (2)

Vendor	Product
apache	axis2
sap	businessobjects

Public exploits

Source	Title	Date
exploit-db	CA ARCserve D2D r15 - Web Service Servlet Code Execution	2010-12-30
exploit-db	Axis2 - (Authenticated) Code Execution (via REST) (Metasploit)	2010-12-14
exploit-db	Axis2 / SAP BusinessObjects - (Authenticated) Code Execution (via SOAP) (Metasploit)	2010-12-14

References

→ the Explorer · watch your stack · NVD