Vulnerability Details : CVE-2016-5002
XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted DTD.
Vulnerability category: XML external entity (XXE) injectionServer-side request forgery (SSRF)
Products affected by CVE-2016-5002
- cpe:2.3:a:apache:xml-rpc:3.1.3:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-5002
7.83%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 91 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-5002
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
NIST | |
|
7.8
|
HIGH | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST |
CWE ids for CVE-2016-5002
-
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-5002
-
http://www.securityfocus.com/bid/91736
Apache XML-RPC Multiple Security VulnerabilitiesThird Party Advisory;VDB Entry
-
https://security.gentoo.org/glsa/202401-26
Apache XML-RPC: Multiple Vulnerabilities (GLSA 202401-26) — Gentoo security
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/115042
Apache Archiva ws-xmlrpc library server-side request forgery CVE-2016-5002 Vulnerability ReportIssue Tracking;Third Party Advisory;VDB Entry
-
https://access.redhat.com/errata/RHSA-2018:3768
RHSA-2018:3768 - Security Advisory - Red Hat Customer Portal
-
https://0ang3el.blogspot.in/2016/07/beware-of-ws-xmlrpc-library-in-your.html
Beware of ws-xmlrpc library in your Java App ~ Из крайности в безопасностьIssue Tracking;Third Party Advisory
-
http://www.securitytracker.com/id/1036294
Apache Archiva Bugs in XML-RPC Library Let Remote Users Conduct Server-Side Request Forgery Attacks, Deny Service, and Potentially Execute Arbitrary Code - SecurityTrackerThird Party Advisory;VDB Entry
-
http://www.openwall.com/lists/oss-security/2016/07/12/5
oss-security - Vulnerabilities in Apache ArchivaMailing List;Third Party Advisory
Jump to