On this page

Atomicorp WAF Rule 340121

Rule Summary

  • Rule ID: 340121
  • Status: Active
  • Alert message: Atomicorp.com WAF Rules: XML-RPC attacks on xmlrpc.php
  • Observed CWEs: CWE-22 (1), CWE-94 (2), CWE-287 (1), CWE-352 (1), CWE-863 (1), CWE-918 (1)
  • Revision: 7
  • Rule severity: Critical (2)
  • Phase: 2 (request body)
  • Request surfaces: XML request data
  • Rule action: deny
  • HTTP status: 403
  • Logging: log, auditlog

Description

This rule detects behavior identified by its current alert as “XML-RPC attacks on xmlrpc.php” in the XML request data. It evaluates during the request body phase and denies matching traffic with HTTP status 403.

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

CVEVulnerabilityProductCVSSSeverity
CVE-2022-24816GeoServer <1.2.2 - Remote Code Executionjai-ext10.0 (v3.1)Critical
CVE-2013-4864MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilitiesveralite firmware9.8 (v3.1)Critical
CVE-2026-29014MetInfo CMS <= 8.1 - Remote Code Executionmetinfo9.3 (v4.0)Critical
CVE-2013-4863MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilitiesveralite firmware8.8 (v3.1)High
CVE-2013-4862MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilitiesveralite firmware8.1 (v3.1)High
CVE-2013-4861MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilitiesveralite firmware6.5 (v3.1)Medium
CVE-2013-4865MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilitiesveralite firmware6.5 (v3.1)Medium

Observed CWEs

These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.

CWERelated Published CVEs
CWE-22CVE-2013-4861
CWE-94CVE-2022-24816 , CVE-2026-29014
CWE-287CVE-2013-4863
CWE-352CVE-2013-4865
CWE-863CVE-2013-4862
CWE-918CVE-2013-4864