org.apache.xmlrpc CVEs

VRT Sign in

Look up CVE IDs Status Exploitation Severity

Reset

Overview 3 matches · 2 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5

3matches 2protected66.7% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%

Protected by Waratek 2 66.7% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 1 33.3%

Critical 1 33.3% High 1 33.3% Medium 1 33.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 2 66.7% partly blocked 0 0.0% not blocked 1 33.3% not established 0 0.0% unrecorded 0 0.0%

Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 3 100.0%

split by StatusSeverityProtectionExploit maturity peak 2 / month

Jun 171 No exploit published1 Medium1 not blocked1 No public exploit1 Jul 170 Aug 170 Sep 170 Oct 172 Protected by Waratek2 Critical1 High1 blocked by ARMR today2 No public exploit2

Jun 17Jul 17Aug 17Sep 17Oct 17

3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2016-5003	Critical	2017-10-27	Protected by Waratek	No public exploit	The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an <ex:serializable> element.
CVE-2016-5002	High	2017-10-27	Protected by Waratek	No public exploit	XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted DTD.
CVE-2016-5004	Medium	2017-06-06	No exploit published	No public exploit	The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service (resource consumption) by decompressing a large file containing zeroes.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2016-5003

Critical

2017-10-27

Protected by Waratek

No public exploit

The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an <ex:serializable> element.

CVE-2016-5002

High

2017-10-27

Protected by Waratek

No public exploit

XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted DTD.

CVE-2016-5004

Medium

2017-06-06

No exploit published

No public exploit

The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service (resource consumption) by decompressing a large file containing zeroes.