Apache Ws-Xmlrpc vulnerabilities

2 CVEs affecting Apache Ws-Xmlrpc, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2016-5003, published 2017-10-27.

More from Apache.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2016-5003, published 2017-10-27. Critical severity, CVSS 9.8. EPSS: 14.9% chance of exploitation in the next 30 days. The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an <ex:serializable> element.
• CVE-2016-5004, published 2017-06-06. Medium severity, CVSS 6.5. EPSS: 7.8% chance of exploitation in the next 30 days. The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service (resource consumption) by decompressing a large file…