A Server-Side Request Forgery (SSRF) vulnerability exists in Apache Axis2/Java versions through 2.0.1. An unauthenticated attacker can supply a non-anonymous WS-Addressing ReplyTo or FaultTo address, causing Axis2 to open connections to arbitrary internal hosts and deliver response content to an attacker-controlled host. This behavior is fixed starting in version 2.0.2 by refusing decoupled responses unless explicitly enabled and restricting allowed endpoints by scheme and header/transport validation.