Apache Axis2/Java allows a server to retrieve any absolute URL specified in a WSDL import or XSD schema file without restricting the scheme or host portion. When an Axis2 application builds a service description from such a file, it will cause the JVM to issue network requests to the referenced hosts. This flaw can be used to force the application server to access arbitrary internal or external resources, enabling data collection, internal enumeration, or further exploitation of downstream services.

The vulnerability exists in all versions of Apache Axis2/Java up to and including 2.0.1. The official fix is delivered in version 2.0.2 and later. Any deployment that processes WSDL or XSD files from untrusted sources is affected.

The attack does not require authentication or elevated privileges on the target; the attacker only needs to supply a malicious WSDL or XSD that the Axis2 application will load. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so while exploitation probability cannot be precisely quantified, SSRF flaws commonly lead to significant security breaches. The CVSS score is not provided in the advisory, so the relative severity must be judged in the context of the specific deployment and threat model.