CVE-2016-5003
Critical · 9.8CVSS
9.8
EPSS
14.9%
Published
Oct 27, 2017
CISA due date
—
The record
The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an <ex:serializable> element.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.xmlrpc:xmlrpc | 0 | No fix |
| Mageia:6 | xmlrpc | 0 | 3.1.3-70.1.mga6 |
| Red Hat:enterprise_linux:6::server | xmlrpc3 | 0 | 0:3.0-4.17.el6_9 |
| Red Hat:enterprise_linux:6::server | xmlrpc3-client | 0 | 0:3.0-4.17.el6_9 |
| Red Hat:enterprise_linux:6::server | xmlrpc3-client-devel | 0 | 0:3.0-4.17.el6_9 |
| Red Hat:enterprise_linux:6::server | xmlrpc3-common | 0 | 0:3.0-4.17.el6_9 |
| Red Hat:enterprise_linux:6::server | xmlrpc3-common-devel | 0 | 0:3.0-4.17.el6_9 |
| Red Hat:enterprise_linux:6::server | xmlrpc3-javadoc | 0 | 0:3.0-4.17.el6_9 |
| Red Hat:enterprise_linux:6::server | xmlrpc3-server | 0 | 0:3.0-4.17.el6_9 |
| Red Hat:enterprise_linux:6::server | xmlrpc3-server-devel | 0 | 0:3.0-4.17.el6_9 |
| Red Hat:enterprise_linux:6::workstation | xmlrpc3 | 0 | 0:3.0-4.17.el6_9 |
| Red Hat:enterprise_linux:6::workstation | xmlrpc3-client | 0 | 0:3.0-4.17.el6_9 |
| Red Hat:enterprise_linux:6::workstation | xmlrpc3-client-devel | 0 | 0:3.0-4.17.el6_9 |
| Red Hat:enterprise_linux:6::workstation | xmlrpc3-common | 0 | 0:3.0-4.17.el6_9 |
| Red Hat:enterprise_linux:6::workstation | xmlrpc3-common-devel | 0 | 0:3.0-4.17.el6_9 |
| Red Hat:enterprise_linux:6::workstation | xmlrpc3-javadoc | 0 | 0:3.0-4.17.el6_9 |
| Red Hat:enterprise_linux:6::workstation | xmlrpc3-server | 0 | 0:3.0-4.17.el6_9 |
| Red Hat:enterprise_linux:6::workstation | xmlrpc3-server-devel | 0 | 0:3.0-4.17.el6_9 |
| Red Hat:enterprise_linux:7::client | xmlrpc | 0 | 1:3.1.3-9.el7_5 |
| Red Hat:enterprise_linux:7::client | xmlrpc-client | 0 | 1:3.1.3-9.el7_5 |
| Red Hat:enterprise_linux:7::client | xmlrpc-common | 0 | 1:3.1.3-9.el7_5 |
| Red Hat:enterprise_linux:7::client | xmlrpc-javadoc | 0 | 1:3.1.3-9.el7_5 |
| Red Hat:enterprise_linux:7::client | xmlrpc-server | 0 | 1:3.1.3-9.el7_5 |
| Red Hat:enterprise_linux:7::computenode | xmlrpc | 0 | 1:3.1.3-9.el7_5 |
| Red Hat:enterprise_linux:7::computenode | xmlrpc-client | 0 | 1:3.1.3-9.el7_5 |
| Red Hat:enterprise_linux:7::computenode | xmlrpc-common | 0 | 1:3.1.3-9.el7_5 |
| Red Hat:enterprise_linux:7::computenode | xmlrpc-javadoc | 0 | 1:3.1.3-9.el7_5 |
| Red Hat:enterprise_linux:7::computenode | xmlrpc-server | 0 | 1:3.1.3-9.el7_5 |
| Red Hat:enterprise_linux:7::hypervisor | xmlrpc | 0 | 1:3.1.3-9.el7_5 |
| Red Hat:enterprise_linux:7::hypervisor | xmlrpc-client | 0 | 1:3.1.3-9.el7_5 |
| Red Hat:enterprise_linux:7::hypervisor | xmlrpc-common | 0 | 1:3.1.3-9.el7_5 |
| Red Hat:enterprise_linux:7::hypervisor | xmlrpc-javadoc | 0 | 1:3.1.3-9.el7_5 |
| Red Hat:enterprise_linux:7::hypervisor | xmlrpc-server | 0 | 1:3.1.3-9.el7_5 |
| Red Hat:enterprise_linux:7::server | xmlrpc | 0 | 1:3.1.3-9.el7_5 |
| Red Hat:enterprise_linux:7::server | xmlrpc-client | 0 | 1:3.1.3-9.el7_5 |
| Red Hat:enterprise_linux:7::server | xmlrpc-common | 0 | 1:3.1.3-9.el7_5 |
| Red Hat:enterprise_linux:7::server | xmlrpc-javadoc | 0 | 1:3.1.3-9.el7_5 |
| Red Hat:enterprise_linux:7::server | xmlrpc-server | 0 | 1:3.1.3-9.el7_5 |
| Red Hat:enterprise_linux:7::workstation | xmlrpc | 0 | 1:3.1.3-9.el7_5 |
| Red Hat:enterprise_linux:7::workstation | xmlrpc-client | 0 | 1:3.1.3-9.el7_5 |
| Red Hat:enterprise_linux:7::workstation | xmlrpc-common | 0 | 1:3.1.3-9.el7_5 |
| Red Hat:enterprise_linux:7::workstation | xmlrpc-javadoc | 0 | 1:3.1.3-9.el7_5 |
| Red Hat:enterprise_linux:7::workstation | xmlrpc-server | 0 | 1:3.1.3-9.el7_5 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-xmlrpc | 0 | 1:3.1.3-8.16.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-xmlrpc-client | 0 | 1:3.1.3-8.16.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-xmlrpc-common | 0 | 1:3.1.3-8.16.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-xmlrpc-javadoc | 0 | 1:3.1.3-8.16.el6 |
| Red Hat:rhel_software_collections:3::el6 | rh-java-common-xmlrpc-server | 0 | 1:3.1.3-8.16.el6 |
| Red Hat:rhel_software_collections:3::el7 | rh-java-common-xmlrpc | 0 | 1:3.1.3-8.16.el7 |
| Red Hat:rhel_software_collections:3::el7 | rh-java-common-xmlrpc-client | 0 | 1:3.1.3-8.16.el7 |
| Red Hat:rhel_software_collections:3::el7 | rh-java-common-xmlrpc-common | 0 | 1:3.1.3-8.16.el7 |
| Red Hat:rhel_software_collections:3::el7 | rh-java-common-xmlrpc-javadoc | 0 | 1:3.1.3-8.16.el7 |
| Red Hat:rhel_software_collections:3::el7 | rh-java-common-xmlrpc-server | 0 | 1:3.1.3-8.16.el7 |
Related vulnerabilities
- CVE-2019-17570 An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponsePars… Also affects org.apache.xmlrpc:xmlrpc
- CVE-2026-114724 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection… CWE-502
- CVE-2026-112081 A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. CWE-502
- CVE-2026-96745 Deserialization of untrusted data in the command monitoring support of the MongoDB PHP… CWE-502
- CVE-2026-62107 Unauthenticated PHP Object Injection in Masteriyo - LMS <= 3.4.0 versions. CWE-502
- CVE-2026-62103 Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions. CWE-502
- CVE-2026-62105 Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions. CWE-502
- CVE-2026-73699 FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows… CWE-502