XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted DTD.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - xmlrpc: XML external entity vulnerability SSRF via a crafted DTD (CVE-2016-5002)

  - xmlrpc: Deserialization of untrusted Java object through <ex:serializable> tag (CVE-2016-5003)

  - The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote     attackers to cause a denial of service (resource consumption) by decompressing a large file containing     zeroes. (CVE-2016-5004)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - xmlrpc: XML external entity vulnerability SSRF via a crafted DTD (CVE-2016-5002)

  - The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote     attackers to cause a denial of service (resource consumption) by decompressing a large file containing     zeroes. (CVE-2016-5004)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - xmlrpc: XML external entity vulnerability SSRF via a crafted DTD (CVE-2016-5002)

  - xmlrpc: Deserialization of server-side exception from faultCause in XMLRPC error response (CVE-2019-17570)

  - The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote     attackers to cause a denial of service (resource consumption) by decompressing a large file containing     zeroes. (CVE-2016-5004)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote host is affected by the vulnerability described in GLSA-202401-26 (Apache XML-RPC: Multiple Vulnerabilities)

  - XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in     Apache Archiva, allows remote attackers to conduct server-side request forgery (SSRF) attacks via a     crafted DTD. (CVE-2016-5002)

  - The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to     execute arbitrary code via a crafted serialized Java object in an <ex:serializable> element.
    (CVE-2016-5003)

  - An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult     method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client     causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be     fixed. (CVE-2019-17570)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2089 advisory.

    XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in     Apache Archiva, allows remote attackers to conduct server-side request forgery (SSRF) attacks via a     crafted DTD. (CVE-2016-5002)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security fix for CVE-2016-5003, CVE-2016-5002

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198808	RHEL 5 : xmlrpc (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198766	RHEL 6 : xmlrpc (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198745	RHEL 7 : xmlrpc (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
195410	RHEL 6 : xmlrpc (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
195397	RHEL 7 : xmlrpc (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
195390	RHEL 5 : xmlrpc (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
189291	GLSA-202401-26 : Apache XML-RPC: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
177159	Amazon Linux 2 : xmlrpc (ALAS-2023-2089)	Nessus	Amazon Linux Local Security Checks	high
120400	Fedora 28 : 1:xmlrpc (2018-4ac4229aa8)	Nessus	Fedora Local Security Checks	critical
110301	Fedora 27 : 1:xmlrpc (2018-6e6f1003d6)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2016-5002

high

Tenable Plugins

critical

high

critical

high

critical

critical

critical

high

critical

critical