A Server-Side Request Forgery (SSRF) vulnerability exists in Apache Axis2/Java versions through 2.0.1. The vulnerability allows an attacker who controls a WSDL or schema processed by an Axis2 application to cause the JVM to send requests to arbitrary internal or external hosts by exploiting the lack of scheme or host restrictions when fetching absolute URLs in wsdl:import locations and schemaLocations. This issue is fixed in version 2.0.2.