| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.xmlrpc:xmlrpc | ≤ 3.1.3 | |
| xml-rpc | = 3.1= 3.1.1= 3.1.2= 3.1.3 | |
| software collections | = 1.0 |
An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code.
Apache XML-RPC is no longer maintained and this issue will not be fixed.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free