CVE-2016-5002

Apache XML-RPC XXE Vulnerability

7.8 HighFix available

CVE-2016-5002 is a high vulnerability (CVSS 7.8) in Apache Xml-rpc, published October 27, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.28%, the 94th percentile. Fixed in xmlrpc 3.1.3-70.1.mga6.

XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted DTD.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

8.28%Up 6.2 points since Feb 4, 2022

What each source reports

NVD Score used 7.8

Record: CVE-2016-5002
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness: CWE-611
Updated: 2026-11-02

CVE List No score

Record: CVE-2016-5002
Updated: 2026-11-02

EUVDEUVD-2022-5608 No score

Record: EUVD-2022-5608
Updated: 2026-11-03

GitHub AdvisoriesGHSA-wp35-6jqv-r33m 7.8

Apache XML-RPC XXE Vulnerability

Record: GHSA-wp35-6jqv-r33m
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-611
Updated: 2026-11-02

OSVGHSA-wp35-6jqv-r33m 7.8

Apache XML-RPC XXE Vulnerability

Record: GHSA-wp35-6jqv-r33m
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-611
Updated: 2026-11-02

OSVMGASA-2019-0002 No score

Updated xmlrpc packages fix security vulnerabilities

A flaw was discovered in the Apache XML-RPC (ws-xmlrpc) library that deserializes untrusted data when enabledForExtensions setting is enabled. A remote attacker could use this vulnerability to execute arbitrary code via a crafted serialized Java object in a ex:serializable element (CVE-2016-5003).

Record: MGASA-2019-0002
Updated: 2026-11-02

Affected products

apache xml-rpc

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.xmlrpc:xmlrpc` Maven	through 3.1.3	None known
`org.apache.xmlrpc:xmlrpc` Maven	through 3.1.3, plus listed versions 3.03.0b13.0rc13.13.1.13.1.2	None known
`xmlrpc` Mageia:6	before 3.1.3-70.1.mga6	3.1.3-70.1.mga6

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 9 moreShow less