SAP BusinessObjects 'Axis2' Component Default Password Security Bypass Vulnerability
BID:44055
Info
SAP BusinessObjects 'Axis2' Component Default Password Security Bypass Vulnerability
| Bugtraq ID: | 44055 |
| Class: | Design Error |
| CVE: |
CVE-2010-0219 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 13 2010 12:00AM |
| Updated: | Aug 13 2013 02:56PM |
| Credit: | Joshua Abraham and Will Vandevanter |
| Vulnerable: |
SAP Business Objects 0 Apache Software Foundation Axis2 1.5.2 Apache Software Foundation Axis2 1.5.1 Apache Software Foundation Axis2 1.4.1 Apache Software Foundation Axis2 1.6 Apache Software Foundation Axis2 1.5 |
| Not Vulnerable: | |
Discussion
SAP BusinessObjects 'Axis2' Component Default Password Security Bypass Vulnerability
The 'Axis2' component of SAP BusinessObjects is prone to a vulnerability that allows attackers to bypass certain security restrictions.
An attacker with access to the Axis2 port can exploit this issue to bypass certain security restrictions and gain access to the application. Successfully exploiting this issue will allow attackers to execute arbitrary code within the context of the application.
Other products from multiple vendors that embed the 'Axis2' component may also be affected.
The 'Axis2' component of SAP BusinessObjects is prone to a vulnerability that allows attackers to bypass certain security restrictions.
An attacker with access to the Axis2 port can exploit this issue to bypass certain security restrictions and gain access to the application. Successfully exploiting this issue will allow attackers to execute arbitrary code within the context of the application.
Other products from multiple vendors that embed the 'Axis2' component may also be affected.
Exploit / POC
SAP BusinessObjects 'Axis2' Component Default Password Security Bypass Vulnerability
An attacker can use readily available tools to exploit this issue.
An attacker can use readily available tools to exploit this issue.
Solution / Fix
SAP BusinessObjects 'Axis2' Component Default Password Security Bypass Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
SAP BusinessObjects 'Axis2' Component Default Password Security Bypass Vulnerability
References:
References: