{"id":"CVE-2016-5002","description":"XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted DTD.","cvssScore":7.8,"cvssVersion":"3.0","cvssVector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvssMetrics":[{"version":"3.0","score":7.8,"severity":"HIGH","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"nvd@nist.gov","sourceName":"NVD","type":"Primary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","source":"nvd@nist.gov","sourceName":"NVD","type":"Primary"}],"cwes":["CWE-611"],"resolved":"MITIGATED-BY-RASP","published":"2017-10-27","lastModified":"2026-06-17","affectedProducts":[{"vendor":"apache","product":"xml-rpc","version":"3.1.3"}],"totalAffectedProducts":1,"references":[{"url":"https://access.redhat.com/errata/RHSA-2018:3768","source":"osv","tags":["WEB"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/115042","source":"osv","tags":["WEB"]},{"url":"https://security.gentoo.org/glsa/202401-26","source":"osv","tags":["WEB"]},{"url":"https://web.archive.org/web/20210123151805/http://www.securityfocus.com/bid/91736","source":"osv","tags":["WEB"]},{"url":"https://web.archive.org/web/20211021044107/http://www.securitytracker.com/id/1036294","source":"osv","tags":["WEB"]},{"url":"https://web.archive.org/web/20230520164025/https://0ang3el.blogspot.com/2016/07/beware-of-ws-xmlrpc-library-in-your.html","source":"osv","tags":["WEB"]},{"url":"http://www.openwall.com/lists/oss-security/2016/07/12/5","source":"osv","tags":["WEB"]},{"url":"http://www.securityfocus.com/bid/91736","source":"osv","tags":["WEB"]},{"url":"http://www.securitytracker.com/id/1036294","source":"osv","tags":["WEB"]},{"url":"https://0ang3el.blogspot.in/2016/07/beware-of-ws-xmlrpc-library-in-your.html","source":"secalert@redhat.com","tags":["Issue Tracking","Third Party Advisory"]}],"reasoning":{"decidingSource":"secure-rule-match","decidingReason":"Promoted to MITIGATED-BY-RASP (security rule): this CVE's weakness (CWE-611: XML External Entity Reference) can be mitigated by an ARMR xxe security rule that blocks this class of attack at the JVM level, without requiring a CVE-specific patch.","verdicts":[{"rule":"rejected","stage":"identity","outcome":"no-match"},{"rule":"armr-patch-file","stage":"scope","outcome":"no-match"},{"rule":"armr-secure-rule-file","stage":"scope","outcome":"no-match"},{"rule":"manual-classification","stage":"scope","outcome":"no-match"},{"rule":"h2-history","stage":"scope","outcome":"no-match"},{"rule":"non-java-upstream","stage":"scope","outcome":"no-match"},{"rule":"oracle-component","stage":"scope","outcome":"no-match"},{"rule":"osv-maven","stage":"scope","outcome":"matched","status":"QUEUED-FOR-REVIEW","detail":"Maven packages: org.apache.xmlrpc:xmlrpc"},{"rule":"patch-hint","stage":"disposition","outcome":"no-match"},{"rule":"open-source-maven","stage":"disposition","outcome":"matched","status":"MITIGATION-CANDIDATE","detail":"Open-source Maven artifact indexed by OSV (Maven packages: org.apache.xmlrpc:xmlrpc). The source is public, which makes an ARMR patch rule a candidate; nothing here establishes that one can be written."},{"rule":"poc-derivable","stage":"disposition","outcome":"skipped"},{"rule":"no-exploit","stage":"disposition","outcome":"skipped"},{"rule":"secure-rule-match","stage":"disposition","outcome":"matched","status":"MITIGATED-BY-RASP","detail":"CWE-611 (XML External Entity Reference) is mitigable by an ARMR xxe security rule.","decisive":true},{"rule":"below-action-threshold","stage":"disposition","outcome":"skipped"},{"rule":"no-exploit-published","stage":"disposition","outcome":"skipped"}],"affectedProducts":[{"vendor":"apache","product":"xml-rpc","isKnown":false,"cpe":"cpe:2.3:a:apache:xml-rpc:3.1.3:*:*:*:*:*:*:*"}],"affectedPackages":[{"name":"org.apache.xmlrpc:xmlrpc","introduced":"0","lastAffected":"3.1.3"}]},"assessment":{"record":{"state":"active"},"protection":{"level":"full","mechanisms":["security-rule"]},"action":{"state":"available","type":"security-rule"},"review":{"state":"automated","basis":"inferred"}},"signals":{"hasPOC":false,"pocCount":0},"kev":{"inKEV":false},"epss":{"available":true,"score":0.08275,"percentile":0.94596},"ssvc":{"available":false}}