Apache Axis2/Java allows an unauthenticated caller to provide a non‑anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address. The server then opens a connection to that address to deliver the response or fault, enabling the attacker to request internal hosts and optionally return response content to an arbitrary external host. This Server‑Side Request Forgery (SSRF) can bypass normal network isolation and expose sensitive internal resources.

The vulnerability affects Apache Axis2/Java versions up to and including 2.0.1. Starting with 2.0.2, decoupled responses are refused unless allowNonAnonymousResponseEndpoints is explicitly enabled, and enabled endpoints are restricted by scheme and screened at both the header‑parsing and transport‑selection layers.

Because the flaw can be triggered by any entity able to invoke the Axis2 web service and requires no authentication, the attack surface is broad. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The risk is high: an attacker could force the server to reach internal targets, potentially revealing internal addresses, harvesting data, or establishing a foothold for further compromise. The likely attack vector is the SOAP web service interface; a malicious SOAP request containing a crafted ReplyTo or FaultTo endpoint will be resolved and connected to by the Axis2 runtime.