Improper neutralization of input during web page generation (CWE‑79) allows an attacker to inject malicious scripts into the Swagger UI page served by the OpenAPI module of Apache Axis2/Java. The vulnerability arises because the module writes the value of the request’s Host header directly into the page without encoding or validation. If an attacker controls the Host header, arbitrary JavaScript can be executed in the context of the Axis2 origin, enabling payloads that can steal session tokens, deface the web page, or hijack user accounts.

Apache Software Foundation – Apache Axis2/Java, version 2.0.1 is affected. Users running this version are susceptible to the flaw; upgrading to 2.0.2 removes the vulnerability.

The flaw can be triggered remotely by sending a crafted HTTP request with a malicious Host header to the Swagger UI endpoint. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, indicating that it may not yet be actively exploited in the wild, but the potential impact of uncontrolled script execution is significant. The lack of a published CVSS score means that users should treat the vulnerability as high risk, given the severity of the XSS payload and the ease of exploitation via standard HTTP traffic.