... anyone with access to the Axis2 port can gain full access to the machine via arbitrary remote code execution. This requires the attacker to upload a malicious web service and to restart the instance of Tomcat. This issue may apply to other products and vendors that embed the Axis2 component. The username is "admin" and the password is "axis2", this is also the default for standalone Axis2 installations.
For further details please refer to the links below. An exploit is currently available for this.
https://websmp230.sap-ag.de/sap/support/notes/1432881 (requires login)
email: david @ sharpesecurity.com