CVE-2026-120832

MEDIUM

MEDIUM Priority: 0.02 BB Relevance: 73/100

Published: 2026-11-09 Modified: 2026-11-12 First seen: 2026-11-09 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network

AC: Low

PR: None

UI: None

S: Unchanged

C: Low

I: Low

A: None

Description

Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. When Axis2 built a service description from a WSDL, through ServiceClient, AxisService.createClientSideAxisService or WSDLToAxisServiceBuilder, it fetched the absolute URLs in wsdl:import locations and in xsd:import and xsd:include schemaLocations with no scheme or host restriction; the AAR and WAR deployment resolvers also passed absolute schema locations on to the network. An attacker who controls a WSDL or schema processed by an Axis2 application could therefore make the JVM send requests to arbitrary internal or external hosts. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

Weakness Classification (1)

CWE-918 — CWE-918 Server-Side request forgery (SSRF)

Affected Software (3)

Vendor	Product	Version
Apache Software Foundation	Apache Axis2/Java	0 < 2.0.2
Apache Software Foundation	Apache Axis2/Java	0 < 2.0.2
Apache Software Foundation	Apache Axis2/Java	0 < 2.0.2