CVE-2016-5003 Apache XML-RPC vulnerable to Deserialization of Untrusted Data
CriticalCVSS 9.8
EPSS 14.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an ex:serializable element.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.xmlrpc/xmlrpc(Maven) | <= 3.1.3 | No fix listed |
| org.apache.xmlrpc/xmlrpc(Maven) | = 3.0 | No fix listed |
| org.apache.xmlrpc/xmlrpc(Maven) | = 3.0b1 | No fix listed |
| org.apache.xmlrpc/xmlrpc(Maven) | = 3.0rc1 | No fix listed |
| org.apache.xmlrpc/xmlrpc(Maven) | = 3.1 | No fix listed |
| org.apache.xmlrpc/xmlrpc(Maven) | = 3.1.1 | No fix listed |
| org.apache.xmlrpc/xmlrpc(Maven) | = 3.1.2 | No fix listed |
| org.apache.xmlrpc/xmlrpc(Maven) | = 3.1.3 | No fix listed |
| apache ws-xmlrpc | = 3.1.3 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- www.openwall.com
- www.openwall.com
- www.openwall.com
- web.archive.org
- web.archive.org
- web.archive.org
- security.gentoo.org
- apache-archiva-cve20165003-code-exec(115043) third-party-advisory vdb-entry
- bugzilla.redhat.com
- access.redhat.com
- RHSA-2018:3768 vendor-advisory
- RHSA-2018:2317 vendor-advisory
- RHSA-2018:1784 vendor-advisory
- RHSA-2018:1780 vendor-advisory
- RHSA-2018:1779 vendor-advisory
- 0ang3el.blogspot.ru exploit third-party-advisory
- [oss-security] 20160712 Vulnerabilities in Apache Archiva mailing-list third-party-advisory
- [oss-security] 20200116 [CVE-2019-17570] xmlrpc-common untrusted deserialization mailing-list
- [oss-security] 20200124 RE: [CVE-2019-17570] xmlrpc-common untrusted deserialization mailing-list
- github.com
- 91736 third-party-advisory vdb-entry
- 91738 third-party-advisory vdb-entry
- 1036294 third-party-advisory vdb-entry