apache ws-xmlrpc vulnerabilities

Latest apache ws-xmlrpc CVEs

Newest publication first

1. CVE-2016-5003 Apache XML-RPC vulnerable to Deserialization of Untrusted Data

   Published 2017-10-27

   Critical·CVSS 9.8 EPSS 14.9%

   The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an ex:serializable element.

2. CVE-2016-5004 ws-xmlrpc DoS Vulnerability

   Published 2017-06-06

   Medium·CVSS 6.5 EPSS 7.7%

   The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service (resource consumption) by decompressing a large file containing zeroes.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.