CVE-2016-5002 - XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used

CVE-2016-5002

Summary

XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted DTD.

References

Vulnerable Configurations

cpe:2.3:a:apache:xml-rpc:3.1.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:xml-rpc:3.1.3:*:*:*:*:*:*:*

CVSS

Base:	9.3 (as of 22-01-2024 - 17:15)
Impact:
Exploitability:

CWE

CWE-611

CAPEC

XML External Entities Blowup
This attack takes advantage of the entity replacement property of XML where the value of the replacement is a URI. A well-crafted XML document could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	COMPLETE	COMPLETE

cvss-vector via4

AV:N/AC:M/Au:N/C:C/I:C/A:C

redhat via4

advisories

rhsa

id	RHSA-2018:3768

refmap via4

bid	91736
misc	https://0ang3el.blogspot.in/2016/07/beware-of-ws-xmlrpc-library-in-your.html
mlist	[oss-security] 20160712 Vulnerabilities in Apache Archiva
sectrack	1036294
xf	apache-archiva-cve20165002-ssrf(115042)

Last major update

22-01-2024 - 17:15

Published

27-10-2017 - 18:29

Last modified

22-01-2024 - 17:15