Apache XML-RPC vulnerabilities

2 CVEs affecting Apache XML-RPC, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-17570, published 2020-01-23.

More from Apache.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2019-17570, published 2020-01-23. Critical severity, CVSS 9.8. EPSS: 49.3% chance of exploitation in the next 30 days. An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a…
• CVE-2016-5002, published 2017-10-27. High severity, CVSS 7.8. EPSS: 8.3% chance of exploitation in the next 30 days. XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery (SSRF) attacks…