PT-2016-3245 · Apache · Apache Xml-Rpc Library

0Ang3El · Publicado 2016-07-12 · Atualizado 2024-01-22 · CVE-2016-5002

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache XML-RPC library version 3.1.3

Description The issue is related to an XML external entity (XXE) vulnerability in the Apache XML-RPC library. This vulnerability allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted DTD. The vulnerability is caused by incorrect restriction of XML links to external objects.

Recommendations For Apache XML-RPC library version 3.1.3, consider disabling the XML external entity processing to prevent SSRF attacks until a patch is available. Restrict access to the library to minimize the risk of exploitation. Avoid using crafted DTDs in the affected library until the issue is resolved.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

BDU:2018-00149

CVE-2016-5002

GHSA-WP35-6JQV-R33M

MGASA-2019-0002

Produtos afetados

Apache Xml-Rpc Library

Referências · 19

• https://0ang3el.blogspot.in/2016/07/beware-of-ws-xmlrpc-library-in-your.html · Nota
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/5AEMJ2ZNFZVGVMACAZMQQCBOFBVUTNZA · Aviso do Fabricante
• https://t.me/cvenotify/68228 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2016-5002 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2019-0002.html · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2018:3768 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-5002 · Nota de Segurança
• http://securitytracker.com/id/1036294 · Nota
• https://bugs.mageia.org/show_bug.cgi?id=23105 · Nota
• https://web.archive.org/web/20210123151805/http://securityfocus.com/bid/91736 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/115042 · Nota
• https://security.gentoo.org/glsa/202401-26 · Nota
• https://web.archive.org/web/20230520164025/https://0ang3el.blogspot.com/2016/07/beware-of-ws-xmlrpc-library-in-your.html · Nota
• https://bdu.fstec.ru/vul/2018-00149 · Nota de Segurança
• https://web.archive.org/web/20211021044107/http://securitytracker.com/id/1036294 · Nota