{"id":"CVE-2016-5003","aliases":["EUVD-2022-2380","GHSA-4gqp-296r-j5mq","MGASA-2019-0002","RHSA-2018:1779","RHSA-2018:1780","RHSA-2018:1784","RHSA-2018:2317"],"status":"published","title":"Apache XML-RPC vulnerable to Deserialization of Untrusted Data","description":"The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an \u003cex:serializable\u003e element.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.14876,"percentile":0.96717,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502"],"published":"2017-10-27T18:00:00Z","modified":"2026-08-05T10:05:32Z","fixes":[{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"xmlrpc3","fixed_in":["0:3.0-4.17.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"xmlrpc3-client","fixed_in":["0:3.0-4.17.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"xmlrpc3-common","fixed_in":["0:3.0-4.17.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"xmlrpc3-client-devel","fixed_in":["0:3.0-4.17.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"xmlrpc3-common-devel","fixed_in":["0:3.0-4.17.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"xmlrpc3-javadoc","fixed_in":["0:3.0-4.17.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"xmlrpc3-server","fixed_in":["0:3.0-4.17.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"xmlrpc3-server-devel","fixed_in":["0:3.0-4.17.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xmlrpc3","fixed_in":["0:3.0-4.17.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xmlrpc3-client","fixed_in":["0:3.0-4.17.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xmlrpc3-common","fixed_in":["0:3.0-4.17.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xmlrpc3-client-devel","fixed_in":["0:3.0-4.17.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xmlrpc3-common-devel","fixed_in":["0:3.0-4.17.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xmlrpc3-javadoc","fixed_in":["0:3.0-4.17.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xmlrpc3-server","fixed_in":["0:3.0-4.17.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xmlrpc3-server-devel","fixed_in":["0:3.0-4.17.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"xmlrpc","fixed_in":["1:3.1.3-9.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"xmlrpc-client","fixed_in":["1:3.1.3-9.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"xmlrpc-common","fixed_in":["1:3.1.3-9.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"xmlrpc-javadoc","fixed_in":["1:3.1.3-9.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"xmlrpc-server","fixed_in":["1:3.1.3-9.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xmlrpc","fixed_in":["1:3.1.3-9.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xmlrpc-client","fixed_in":["1:3.1.3-9.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xmlrpc-common","fixed_in":["1:3.1.3-9.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xmlrpc-javadoc","fixed_in":["1:3.1.3-9.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xmlrpc-server","fixed_in":["1:3.1.3-9.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"xmlrpc","fixed_in":["1:3.1.3-9.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"xmlrpc-client","fixed_in":["1:3.1.3-9.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"xmlrpc-common","fixed_in":["1:3.1.3-9.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"xmlrpc-javadoc","fixed_in":["1:3.1.3-9.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"xmlrpc-server","fixed_in":["1:3.1.3-9.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xmlrpc","fixed_in":["1:3.1.3-9.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xmlrpc-client","fixed_in":["1:3.1.3-9.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xmlrpc-common","fixed_in":["1:3.1.3-9.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xmlrpc-javadoc","fixed_in":["1:3.1.3-9.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xmlrpc-server","fixed_in":["1:3.1.3-9.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-java-common-xmlrpc","fixed_in":["1:3.1.3-8.16.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-java-common-xmlrpc-client","fixed_in":["1:3.1.3-8.16.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-java-common-xmlrpc-common","fixed_in":["1:3.1.3-8.16.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-java-common-xmlrpc-javadoc","fixed_in":["1:3.1.3-8.16.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-java-common-xmlrpc-server","fixed_in":["1:3.1.3-8.16.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-java-common-xmlrpc","fixed_in":["1:3.1.3-8.16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-java-common-xmlrpc-client","fixed_in":["1:3.1.3-8.16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-java-common-xmlrpc-common","fixed_in":["1:3.1.3-8.16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-java-common-xmlrpc-javadoc","fixed_in":["1:3.1.3-8.16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-java-common-xmlrpc-server","fixed_in":["1:3.1.3-8.16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"xmlrpc","fixed_in":["1:3.1.3-9.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"xmlrpc-client","fixed_in":["1:3.1.3-9.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"xmlrpc-common","fixed_in":["1:3.1.3-9.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"xmlrpc-javadoc","fixed_in":["1:3.1.3-9.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"xmlrpc-server","fixed_in":["1:3.1.3-9.el7_5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.xmlrpc:xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.1.3"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.xmlrpc:xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.1.3"}]}],"versions":["3.0","3.0b1","3.0rc1","3.1","3.1.1","3.1.2","3.1.3"]},{"source":"osv","ecosystem":"Mageia:6","package":"xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-70.1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"xmlrpc3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0-4.17.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"xmlrpc3-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0-4.17.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"xmlrpc3-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0-4.17.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"xmlrpc3-client-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0-4.17.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"xmlrpc3-common-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0-4.17.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"xmlrpc3-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0-4.17.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"xmlrpc3-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0-4.17.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"xmlrpc3-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0-4.17.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xmlrpc3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0-4.17.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xmlrpc3-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0-4.17.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xmlrpc3-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0-4.17.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xmlrpc3-client-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0-4.17.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xmlrpc3-common-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0-4.17.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xmlrpc3-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0-4.17.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xmlrpc3-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0-4.17.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xmlrpc3-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0-4.17.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-9.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"xmlrpc-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-9.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"xmlrpc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-9.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"xmlrpc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-9.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"xmlrpc-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-9.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-9.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xmlrpc-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-9.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xmlrpc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-9.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xmlrpc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-9.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xmlrpc-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-9.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-9.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"xmlrpc-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-9.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"xmlrpc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-9.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"xmlrpc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-9.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"xmlrpc-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-9.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-9.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xmlrpc-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-9.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xmlrpc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-9.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xmlrpc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-9.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xmlrpc-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-9.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-java-common-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-8.16.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-java-common-xmlrpc-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-8.16.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-java-common-xmlrpc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-8.16.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-java-common-xmlrpc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-8.16.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-java-common-xmlrpc-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-8.16.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-java-common-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-8.16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-java-common-xmlrpc-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-8.16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-java-common-xmlrpc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-8.16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-java-common-xmlrpc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-8.16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-java-common-xmlrpc-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-8.16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-9.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"xmlrpc-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-9.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"xmlrpc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-9.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"xmlrpc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-9.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"xmlrpc-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-9.el7_5"}]}]}],"products":[{"vendor":"apache","product":"ws-xmlrpc"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2016/07/12/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1779","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1784","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web","advisory"]},{"url":"http://www.securityfocus.com/bid/91738","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2317","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web","advisory"]},{"url":"http://www.securitytracker.com/id/1036294","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1780","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web","advisory"]},{"url":"https://0ang3el.blogspot.ru/2016/07/beware-of-ws-xmlrpc-library-in-your.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/115043","tags":["vdb-entry","x_refsource_XF","x_transferred","Third Party Advisory","VDB Entry","web"]},{"url":"http://www.securityfocus.com/bid/91736","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3768","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2020/01/16/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2020/01/24/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202401-26","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5003","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5003","tags":["web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1508123","tags":["web","report"]},{"url":"https://web.archive.org/web/20160716070844/http://www.securitytracker.com/id/1036294","tags":["web"]},{"url":"https://web.archive.org/web/20171111065719/http://www.securityfocus.com/bid/91736","tags":["web"]},{"url":"https://web.archive.org/web/20200227235226/http://www.securityfocus.com/bid/91738","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2016/07/12/5","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2020/01/16/1","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2020/01/24/2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4gqp-296r-j5mq"},{"url":"https://advisories.mageia.org/MGASA-2019-0002.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23105","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/5AEMJ2ZNFZVGVMACAZMQQCBOFBVUTNZA/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1779.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5003","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1780.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1784.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2317.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2016-5003","description":"The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an \u003cex:serializable\u003e element.","status":"published","published":"2017-10-27T18:00:00Z","modified":"2025-02-13T16:27:15.179Z","updated_at":"2026-11-02T14:33:31.117878Z"}],"euvd":[{"id":"EUVD-2022-2380","description":"The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an \u003cex:serializable\u003e element.","status":"published","published":"2017-10-27T18:00:00Z","modified":"2025-02-13T16:27:15Z","updated_at":"2026-11-03T00:03:53.290549Z"}],"ghsa":[{"id":"GHSA-4gqp-296r-j5mq","title":"Apache XML-RPC vulnerable to Deserialization of Untrusted Data","description":"The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an \u003cex:serializable\u003e element.","status":"published","published":"2022-05-14T01:53:10Z","modified":"2024-01-22T19:31:44Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:37:31.550603Z"}],"nvd":[{"id":"CVE-2016-5003","description":"The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an \u003cex:serializable\u003e element.","status":"published","published":"2017-10-27T18:29:00.26Z","modified":"2026-06-17T00:48:35.743Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:03:39.176887Z"}],"osv":[{"id":"GHSA-4gqp-296r-j5mq","title":"Apache XML-RPC vulnerable to Deserialization of Untrusted Data","description":"The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an \u003cex:serializable\u003e element.","status":"published","published":"2022-05-14T01:53:10Z","modified":"2024-03-08T05:19:48.548774Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:37.148947Z"},{"id":"RHSA-2018:1779","title":"Red Hat Security Advisory: xmlrpc3 security update","status":"published","published":"2024-09-13T11:08:01Z","modified":"2026-08-05T10:05:26Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"RHSA-2018:1780","title":"Red Hat Security Advisory: xmlrpc security update","status":"published","published":"2024-09-13T11:07:55Z","modified":"2026-08-05T10:05:26Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"RHSA-2018:1784","title":"Red Hat Security Advisory: rh-java-common-xmlrpc security update","status":"published","published":"2024-09-13T11:07:50Z","modified":"2026-08-05T10:05:27Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"RHSA-2018:2317","title":"Red Hat Security Advisory: xmlrpc security update","status":"published","published":"2024-09-13T11:07:45Z","modified":"2026-08-05T10:05:32Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"MGASA-2019-0002","title":"Updated xmlrpc packages fix security vulnerabilities","description":"XML external entity (XXE) vulnerability in the Apache XML-RPC\n(aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote\nattackers to conduct server-side request forgery (SSRF) attacks via a\ncrafted DTD (CVE-2016-5002).\n\nA flaw was discovered in the Apache XML-RPC (ws-xmlrpc) library that\ndeserializes untrusted data when enabledForExtensions setting is\nenabled. A remote attacker could use this vulnerability to execute\narbitrary code via a crafted serialized Java object in a\n\u003cex:serializable\u003e element (CVE-2016-5003).\n","status":"published","published":"2019-01-05T18:30:16Z","modified":"2026-04-16T06:25:56.73972618Z","updated_at":"2026-11-02T15:49:40.793816Z"}]}}