The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an <ex:serializable> element.
CVSS Details
- CVSS 3.0 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade xmlrpc-commonUpgrade xmlrpc-serverUpgrade xmlrpc-clientUpgrade xmlrpc-javadoc | Apr 27, 2020 | Oct 27, 2017 |
| Centos_linux | — | Upgrade xmlrpc-commonUpgrade xmlrpc3-javadocUpgrade xmlrpc3-common-develUpgrade xmlrpc-serverUpgrade xmlrpc3-serverUpgrade xmlrpc3-commonUpgrade xmlrpc-clientUpgrade xmlrpc3-server-develUpgrade xmlrpc3-client-develUpgrade xmlrpc3-clientUpgrade xmlrpc-javadoc | Jun 5, 2018 | Oct 27, 2017 |
| Gentoo Linux | — | Upgrade dev-java/xmlrpc. | Jan 23, 2024 | Oct 27, 2017 |
| Oracle_linux | — | Upgrade xmlrpc3-commonUpgrade xmlrpc3-javadocUpgrade xmlrpc-serverUpgrade xmlrpc-javadocUpgrade xmlrpc3-serverUpgrade xmlrpc3-client-develUpgrade xmlrpc-commonUpgrade xmlrpc3-common-develUpgrade xmlrpc3-server-develUpgrade xmlrpc-clientUpgrade xmlrpc3-client | Jun 1, 2018 | May 24, 2016 |
| Redhat_linux | — | Upgrade xmlrpc-javadocNo solution existsUpgrade xmlrpc-serverUpgrade xmlrpc3-commonUpgrade xmlrpc3-javadocUpgrade xmlrpc3-serverUpgrade xmlrpc3-client-develUpgrade xmlrpc3-common-develUpgrade xmlrpc3-server-develUpgrade xmlrpc-clientUpgrade xmlrpc3-clientUpgrade xmlrpc-common | Jun 1, 2018 | Oct 27, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub