This vulnerability arises from the server’s XML parser processing external entity references in WSDL and XSD documents. An attacker who controls the WSDL or any imported schema can cause the service to read arbitrary local files or send authorized requests to external hosts, exposing sensitive information or allowing further actions on the server.

Apache Software Foundation’s Apache Axis2/Java is affected for all releases up to and including version 2.0.1. Users of this software should review the release notes for Axis2/Java 2.0.2 for the fix.

The CVSS score is not listed in the data and the EPSS score is unavailable, and the vulnerability is not yet in the CISA KEV catalog. Nevertheless, because it can be triggered by any client that loads an external WSDL, the attack vector is remote, and an attacker can read sensitive files or initiate unintended network activity. Given the lack of publicly documented exploits, monitoring is prudent, but the potential impact warrants prompt remediation.