PT-2016-3245 · Apache · Apache Xml-Rpc Library

0Ang3El · Published 2016-07-12 · Updated 2024-01-22 · CVE-2016-5002

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache XML-RPC library version 3.1.3

Description The issue is related to an XML external entity (XXE) vulnerability in the Apache XML-RPC library. This vulnerability allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted DTD. The vulnerability is caused by incorrect restriction of XML links to external objects.

Recommendations For Apache XML-RPC library version 3.1.3, consider disabling the XML external entity processing to prevent SSRF attacks until a patch is available. Restrict access to the library to minimize the risk of exploitation. Avoid using crafted DTDs in the affected library until the issue is resolved.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2018-00149

CVE-2016-5002

GHSA-WP35-6JQV-R33M

MGASA-2019-0002

Affected Products

Apache Xml-Rpc Library

References · 19

• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/5AEMJ2ZNFZVGVMACAZMQQCBOFBVUTNZA · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-5002 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0002.html · Security Note
• https://access.redhat.com/errata/RHSA-2018:3768 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-5002 · Security Note
• https://bdu.fstec.ru/vul/2018-00149 · Security Note
• https://osv.dev/vulnerability/GHSA-wp35-6jqv-r33m · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0002 · Vendor Advisory
• https://0ang3el.blogspot.in/2016/07/beware-of-ws-xmlrpc-library-in-your.html · Note
• https://t.me/cvenotify/68228 · Telegram Post
• http://securitytracker.com/id/1036294 · Note
• https://bugs.mageia.org/show_bug.cgi?id=23105 · Note
• https://web.archive.org/web/20210123151805/http://securityfocus.com/bid/91736 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/115042 · Note
• https://security.gentoo.org/glsa/202401-26 · Note