Every CVE Search/ Get API key

CVE-2016-5003

Apache XML-RPC vulnerable to Deserialization of Untrusted Data

9.8 CriticalFix available

The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an ex:serializable element.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

14.9%Down 55.1 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 9.8

The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an ex:serializable element.

Record
CVE-2016-5003
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-502
Updated
2026-11-02
CVE List No score

The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an ex:serializable element.

Record
CVE-2016-5003
Updated
2026-11-02
EUVDEUVD-2022-2380 No score

The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an ex:serializable element.

Record
EUVD-2022-2380
Updated
2026-11-03
GitHub AdvisoriesGHSA-4gqp-296r-j5mq 9.8

Apache XML-RPC vulnerable to Deserialization of Untrusted Data

The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an ex:serializable element.

Record
GHSA-4gqp-296r-j5mq
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
OSVGHSA-4gqp-296r-j5mq 9.8

Apache XML-RPC vulnerable to Deserialization of Untrusted Data

The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an ex:serializable element.

Record
GHSA-4gqp-296r-j5mq
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
OSVRHSA-2018:1779 7.5

Red Hat Security Advisory: xmlrpc3 security update

Record
RHSA-2018:1779
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVRHSA-2018:1780 7.5

Red Hat Security Advisory: xmlrpc security update

Record
RHSA-2018:1780
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2018:1784 7.5

Red Hat Security Advisory: rh-java-common-xmlrpc security update

Record
RHSA-2018:1784
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2018:2317 7.5

Red Hat Security Advisory: xmlrpc security update

Record
RHSA-2018:2317
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2019-0002 No score

Updated xmlrpc packages fix security vulnerabilities

XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted DTD (CVE-2016-5002).

A flaw was discovered in the Apache XML-RPC (ws-xmlrpc) library that deserializes untrusted data when enabledForExtensions setting is enabled. A remote attacker could use this vulnerability to execute arbitrary code via a crafted serialized Java object in a ex:serializable element (CVE-2016-5003).

Record
MGASA-2019-0002
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.xmlrpc:xmlrpc
Maven
 through 3.1.3 None known
org.apache.xmlrpc:xmlrpc
Maven
 through 3.1.3, plus listed versions
3.03.0b13.0rc13.13.1.13.1.2
 None known
xmlrpc
Mageia:6
 before 3.1.3-70.1.mga6
3.1.3-70.1.mga6
xmlrpc3
Red Hat:enterprise_linux:6::server
 before 0:3.0-4.17.el6_9
0:3.0-4.17.el6_9
xmlrpc3-client
Red Hat:enterprise_linux:6::server
 before 0:3.0-4.17.el6_9
0:3.0-4.17.el6_9
xmlrpc3-common
Red Hat:enterprise_linux:6::server
 before 0:3.0-4.17.el6_9
0:3.0-4.17.el6_9
xmlrpc3-client-devel
Red Hat:enterprise_linux:6::server
 before 0:3.0-4.17.el6_9
0:3.0-4.17.el6_9
xmlrpc3-common-devel
Red Hat:enterprise_linux:6::server
 before 0:3.0-4.17.el6_9
0:3.0-4.17.el6_9
xmlrpc3-javadoc
Red Hat:enterprise_linux:6::server
 before 0:3.0-4.17.el6_9
0:3.0-4.17.el6_9
xmlrpc3-server
Red Hat:enterprise_linux:6::server
 before 0:3.0-4.17.el6_9
0:3.0-4.17.el6_9
Show 44 moreShow less
Affected packages
PackageAffectedFixed
xmlrpc3-server-devel
Red Hat:enterprise_linux:6::server
 before 0:3.0-4.17.el6_9
0:3.0-4.17.el6_9
xmlrpc3
Red Hat:enterprise_linux:6::workstation
 before 0:3.0-4.17.el6_9
0:3.0-4.17.el6_9
xmlrpc3-client
Red Hat:enterprise_linux:6::workstation
 before 0:3.0-4.17.el6_9
0:3.0-4.17.el6_9
xmlrpc3-common
Red Hat:enterprise_linux:6::workstation
 before 0:3.0-4.17.el6_9
0:3.0-4.17.el6_9
xmlrpc3-client-devel
Red Hat:enterprise_linux:6::workstation
 before 0:3.0-4.17.el6_9
0:3.0-4.17.el6_9
xmlrpc3-common-devel
Red Hat:enterprise_linux:6::workstation
 before 0:3.0-4.17.el6_9
0:3.0-4.17.el6_9
xmlrpc3-javadoc
Red Hat:enterprise_linux:6::workstation
 before 0:3.0-4.17.el6_9
0:3.0-4.17.el6_9
xmlrpc3-server
Red Hat:enterprise_linux:6::workstation
 before 0:3.0-4.17.el6_9
0:3.0-4.17.el6_9
xmlrpc3-server-devel
Red Hat:enterprise_linux:6::workstation
 before 0:3.0-4.17.el6_9
0:3.0-4.17.el6_9
xmlrpc
Red Hat:enterprise_linux:7::client
 before 1:3.1.3-9.el7_5
1:3.1.3-9.el7_5
xmlrpc-client
Red Hat:enterprise_linux:7::client
 before 1:3.1.3-9.el7_5
1:3.1.3-9.el7_5
xmlrpc-common
Red Hat:enterprise_linux:7::client
 before 1:3.1.3-9.el7_5
1:3.1.3-9.el7_5
xmlrpc-javadoc
Red Hat:enterprise_linux:7::client
 before 1:3.1.3-9.el7_5
1:3.1.3-9.el7_5
xmlrpc-server
Red Hat:enterprise_linux:7::client
 before 1:3.1.3-9.el7_5
1:3.1.3-9.el7_5
xmlrpc
Red Hat:enterprise_linux:7::computenode
 before 1:3.1.3-9.el7_5
1:3.1.3-9.el7_5
xmlrpc-client
Red Hat:enterprise_linux:7::computenode
 before 1:3.1.3-9.el7_5
1:3.1.3-9.el7_5
xmlrpc-common
Red Hat:enterprise_linux:7::computenode
 before 1:3.1.3-9.el7_5
1:3.1.3-9.el7_5
xmlrpc-javadoc
Red Hat:enterprise_linux:7::computenode
 before 1:3.1.3-9.el7_5
1:3.1.3-9.el7_5
xmlrpc-server
Red Hat:enterprise_linux:7::computenode
 before 1:3.1.3-9.el7_5
1:3.1.3-9.el7_5
xmlrpc
Red Hat:enterprise_linux:7::server
 before 1:3.1.3-9.el7_5
1:3.1.3-9.el7_5
xmlrpc-client
Red Hat:enterprise_linux:7::server
 before 1:3.1.3-9.el7_5
1:3.1.3-9.el7_5
xmlrpc-common
Red Hat:enterprise_linux:7::server
 before 1:3.1.3-9.el7_5
1:3.1.3-9.el7_5
xmlrpc-javadoc
Red Hat:enterprise_linux:7::server
 before 1:3.1.3-9.el7_5
1:3.1.3-9.el7_5
xmlrpc-server
Red Hat:enterprise_linux:7::server
 before 1:3.1.3-9.el7_5
1:3.1.3-9.el7_5
xmlrpc
Red Hat:enterprise_linux:7::workstation
 before 1:3.1.3-9.el7_5
1:3.1.3-9.el7_5
xmlrpc-client
Red Hat:enterprise_linux:7::workstation
 before 1:3.1.3-9.el7_5
1:3.1.3-9.el7_5
xmlrpc-common
Red Hat:enterprise_linux:7::workstation
 before 1:3.1.3-9.el7_5
1:3.1.3-9.el7_5
xmlrpc-javadoc
Red Hat:enterprise_linux:7::workstation
 before 1:3.1.3-9.el7_5
1:3.1.3-9.el7_5
xmlrpc-server
Red Hat:enterprise_linux:7::workstation
 before 1:3.1.3-9.el7_5
1:3.1.3-9.el7_5
rh-java-common-xmlrpc
Red Hat:rhel_software_collections:3::el6
 before 1:3.1.3-8.16.el6
1:3.1.3-8.16.el6
rh-java-common-xmlrpc-client
Red Hat:rhel_software_collections:3::el6
 before 1:3.1.3-8.16.el6
1:3.1.3-8.16.el6
rh-java-common-xmlrpc-common
Red Hat:rhel_software_collections:3::el6
 before 1:3.1.3-8.16.el6
1:3.1.3-8.16.el6
rh-java-common-xmlrpc-javadoc
Red Hat:rhel_software_collections:3::el6
 before 1:3.1.3-8.16.el6
1:3.1.3-8.16.el6
rh-java-common-xmlrpc-server
Red Hat:rhel_software_collections:3::el6
 before 1:3.1.3-8.16.el6
1:3.1.3-8.16.el6
rh-java-common-xmlrpc
Red Hat:rhel_software_collections:3::el7
 before 1:3.1.3-8.16.el7
1:3.1.3-8.16.el7
rh-java-common-xmlrpc-client
Red Hat:rhel_software_collections:3::el7
 before 1:3.1.3-8.16.el7
1:3.1.3-8.16.el7
rh-java-common-xmlrpc-common
Red Hat:rhel_software_collections:3::el7
 before 1:3.1.3-8.16.el7
1:3.1.3-8.16.el7
rh-java-common-xmlrpc-javadoc
Red Hat:rhel_software_collections:3::el7
 before 1:3.1.3-8.16.el7
1:3.1.3-8.16.el7
rh-java-common-xmlrpc-server
Red Hat:rhel_software_collections:3::el7
 before 1:3.1.3-8.16.el7
1:3.1.3-8.16.el7
xmlrpc
Red Hat:enterprise_linux:7::hypervisor
 before 1:3.1.3-9.el7_5
1:3.1.3-9.el7_5
xmlrpc-client
Red Hat:enterprise_linux:7::hypervisor
 before 1:3.1.3-9.el7_5
1:3.1.3-9.el7_5
xmlrpc-common
Red Hat:enterprise_linux:7::hypervisor
 before 1:3.1.3-9.el7_5
1:3.1.3-9.el7_5
xmlrpc-javadoc
Red Hat:enterprise_linux:7::hypervisor
 before 1:3.1.3-9.el7_5
1:3.1.3-9.el7_5
xmlrpc-server
Red Hat:enterprise_linux:7::hypervisor
 before 1:3.1.3-9.el7_5
1:3.1.3-9.el7_5

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-5003 is a critical vulnerability (CVSS 9.8) in Apache Ws-xmlrpc, published October 27, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 14.9%, the 96th percentile. Fixed in xmlrpc 3.1.3-70.1.mga6.

References

Show 24 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open