CVE-2010-2103 Improper Neutralization of Input During Web Page Generation in Apache Axis2
MediumCVSS 4.3
EPSS 34.9%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.1, 1.5.1, and possibly other versions, as used in SAP Business Objects 12, 3com IMC, and possibly other products, allows remote attackers to inject arbitrary web script or HTML via the modules parameter. NOTE: some of these details are obtained from third party information.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.axis2.wso2/axis2(Maven) | >= 1.4.1, < 1.6.0 | 1.6.0 |
| apache axis2 | = 1.4.1 | No fix listed |
| apache axis2 | = 1.5.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- axis2-modules-xss(58790) vdb-entry
- kb.juniper.net
- 64844 exploit vdb-entry
- spl0it.org
- 12689 exploit
- www.procheckup.com exploit
- github.com
- Debian Security Tracker CVE-2010-2103 vendor-advisory
- 39906 third-party-advisory vendor-advisory
- 20100521 PR10-03: Authenticated Cross-Site Scripting (XSS) within the Apache Axis2 administration console mailing-list
- 40327 exploit vdb-entry
- ADV-2010-1215 vdb-entry vendor-advisory