CVE-2016-5002

High

Published: 27/10/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

An XXE vulnerability in the Apache XML-RPC library version 3.1.3, used in Apache Archiva, allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted DTD.

Risk Assessment

This vulnerability could lead to unauthorized access to server resources, posing a serious threat to the organization's data security.

Recommendation

It is recommended to update the Apache XML-RPC library to the latest version to mitigate this vulnerability and implement appropriate safeguards against SSRF attacks.

Other vulnerabilities in Apache XML-RPC 3.1.3

CVE-2016-5003Critical
The Apache XML-RPC library version 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an <ex:serializable> element.

Original NVD description (English source)

XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted DTD.