CVSS 3.0
7.8 highCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2016-5002
XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted DTD.
Severity
- EPSS
- 8.3% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
- CWE
- CWE-611
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:xml-rpc
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-wp35-6jqv-r33m | Maven | org.apache.xmlrpc:xmlrpc | <=3.1.3 | no fix published |