CVE-2016-5002: Apache XML-RPC

High severity, CVSS 7.8. EPSS: 8.3% chance of exploitation in the next 30 days.

XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted DTD.

Affected products

• Apache XML-RPC: version 3.1.3 only

Published 2017-10-27. Last modified 2026-06-17.