CVE-2016-5002 Apache XML-RPC XXE Vulnerability
HighCVSS 7.8
EPSS 8.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted DTD.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.xmlrpc/xmlrpc(Maven) | <= 3.1.3 | No fix listed |
| org.apache.xmlrpc/xmlrpc(Maven) | = 3.0 | No fix listed |
| org.apache.xmlrpc/xmlrpc(Maven) | = 3.0b1 | No fix listed |
| org.apache.xmlrpc/xmlrpc(Maven) | = 3.0rc1 | No fix listed |
| org.apache.xmlrpc/xmlrpc(Maven) | = 3.1 | No fix listed |
| org.apache.xmlrpc/xmlrpc(Maven) | = 3.1.1 | No fix listed |
| org.apache.xmlrpc/xmlrpc(Maven) | = 3.1.2 | No fix listed |
| org.apache.xmlrpc/xmlrpc(Maven) | = 3.1.3 | No fix listed |
| apache xml-rpc | = 3.1.3 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- RHSA-2018:3768 vendor-advisory
- apache-archiva-cve20165002-ssrf(115042) issue-tracking third-party-advisory vdb-entry
- security.gentoo.org
- web.archive.org
- web.archive.org
- web.archive.org
- [oss-security] 20160712 Vulnerabilities in Apache Archiva mailing-list third-party-advisory
- 91736 third-party-advisory vdb-entry
- 1036294 third-party-advisory vdb-entry
- github.com
- 0ang3el.blogspot.in issue-tracking third-party-advisory