CVE-2016-5003

Description

The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an <ex:serializable> element.

References

https://security.gentoo.org/glsa/202401-26

https://exchange.xforce.ibmcloud.com/vulnerabilities/115043

https://access.redhat.com/errata/RHSA-2018:3768

https://access.redhat.com/errata/RHSA-2018:2317

https://access.redhat.com/errata/RHSA-2018:1784

https://access.redhat.com/errata/RHSA-2018:1780

https://access.redhat.com/errata/RHSA-2018:1779

http://www.securitytracker.com/id/1036294

http://www.securityfocus.com/bid/91738

http://www.securityfocus.com/bid/91736

http://www.openwall.com/lists/oss-security/2020/01/24/2

http://www.openwall.com/lists/oss-security/2020/01/16/1

http://www.openwall.com/lists/oss-security/2016/07/12/5

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3