CVE-2016-5003

CRITICAL

Apache Ws-xmlrpc - Insecure Deserialization

Title source: rule

Description

The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an <ex:serializable> element.

References (14)

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2016/07/12/5

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/91736

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/91738

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id/1036294

[Exploit, Third Party Advisory] https://0ang3el.blogspot.ru/2016/07/beware-of-ws-xmlrpc-library-in-your.html

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2018:1779

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2018:1780

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2018:1784

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2018:2317

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2018:3768

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/115043

[Third Party Advisory] https://security.gentoo.org/glsa/202401-26

[Mailing List] http://www.openwall.com/lists/oss-security/2020/01/16/1

[Mailing List] http://www.openwall.com/lists/oss-security/2020/01/24/2

Scores

CVSS v3 9.8

EPSS 0.4152

EPSS Percentile 97.3%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-502

Status draft

Affected Products (2)

apache/ws-xmlrpc

org.apache.xmlrpc/xmlrpc Maven

Timeline

Published Oct 27, 2017

Tracked Since Feb 18, 2026