vulnwire
6.5med

CVE-2016-5004

ws-xmlrpc DoS Vulnerability

Also known as GHSA-r2pg-w96p-pcpj

Published 9 y ago · modified 4 mo ago · JSON

CVSS
6.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
7.7%
percentile 95%
Public exploits
0
none known

The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service (resource consumption) by decompressing a large file containing zeroes.

Exploit prediction (EPSS)

7.75% probability of exploitation in the next 30 days, higher than 95% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.06.5CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD2.04.3AV:N/AC:M/Au:N/C:N/I:N/A:P
GitHub3.06.5CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.xmlrpc:xmlrpc-common
<=3.1.3
no fix listed

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption

References

  • openwall.com /lists/oss-security/2016/07/12/5 · mailing-list, x_refsource_MLIST, x_transferred
  • securitytracker.com /id/1036294 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • github.com /0ang3el/unsafe-xmlrpc · x_refsource_MISC, x_transferred
  • 0ang3el.blogspot.in /2016/07/beware-of-ws-xmlrpc-library-in-your.html · x_refsource_MISC, x_transferred
  • securityfocus.com /bid/91736 · vdb-entry, x_refsource_BID, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2016-5004 · advisory
  • web.archive.org /web/20160716070844/http://www.securitytracker.com/id/1036294 · web
  • web.archive.org /web/20171111065719/http://www.securityfocus.com/bid/91736 · web
  • web.archive.org /web/20171114185236/https://0ang3el.blogspot.in/2016/07/beware-of-ws-xmlrpc-library-in-you · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.