Cross-site scripting in Apache Archiva
Priority LOW 37CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e. the logo URL. The vulnerability is considered as minor risk, as only users with admin role can change the configuration, or the communication between the browser and the Archiva server must be compromised.
Why it matters now
EPSS 0.04843 92nd percentileScored 2026-11-07
Fix Fixed org.apache.archiva:archiva (Maven): 2.2.4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Archiva | All versions prior to version 2.2.4 | — | No fix listed | CNA |
| — | org.apache.archiva:archiva (Maven) | before 2.2.4 | 2.2.4 | Patch available | GHSA-cqcf-4g4h-rghf |
- Apache Archiva VendorApache Affected All versions prior to version 2.2.4 Fixed in — No fix listed CNA
- org.apache.archiva:archiva (Maven) Vendor— Affected before 2.2.4 Fixed in 2.2.4 Patch available GHSA-cqcf-4g4h-rghf
Remediation
- Fix · GHSA-cqcf-4g4h-rghf org.apache.archiva:archiva (Maven) Fixed in 2.2.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2019-0213
- 2026-10-03 Alias added: GHSA-cqcf-4g4h-rghf
References
Advisory 5
- 20190430 [SECURITY] CVE-2019-0213: Apache Archiva Stored XSS
- [oss-security] 20190430 [SECURITY] CVE-2019-0213: Apache Archiva Stored XSS
- http://packetstormsecurity.com/files/152681/Apache-Archiva-2.2.3-Cross-Site-Scripting.html
- http://archiva.apache.org/security.html#CVE-2019-0213
- https://nvd.nist.gov/vuln/detail/CVE-2019-0213
Other 8
- [maven-users] 20190430 [SECURITY] CVE-2019-0213: Apache Archiva Stored XSS
- [archiva-users] 20190430 [SECURITY] CVE-2019-0213: Apache Archiva Stored XSS
- [archiva-issues] 20190501 [jira] [Created] (MRM-1987) Port security fixes for 2.2.4 to 3.0.0
- [announce] 20190430 [SECURITY] CVE-2019-0213: Apache Archiva Stored XSS
- https://lists.apache.org/thread.html/0397ddbd17b5257cc1746b31a07294a87221c5ca24e5d19d390e28f3@%3Cusers.archiva.apache.org%3E
- https://lists.apache.org/thread.html/7bcea134c3d6fa72cdc1052922ac0914f399f63f4690b7937b80127d@%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/ada0052409d8a4a8c4eb2c7fd6b9cd9423bc753d5fce87eb826662fb@%3Cissues.archiva.apache.org%3E
- https://lists.apache.org/thread.html/c358754a35473a61477f9d487870581a0dd7054ff95974628fa09f97@%3Cusers.maven.apache.org%3E
More Apache Archiva vulnerabilities
- TI-2013-02013 Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL… KEVCVSS 3.1CRITICAL 9.8
- TI-2016-03842 Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.3.9 and… CVSS 3.0HIGH 8.8
- TI-2024-17994 Apache Archiva: incorrect authentication potentially leading to account takeover CVSS 3.1HIGH 7.5
- TI-2024-17993 Apache Archiva: disabling user registration is not effective CVSS 3.1HIGH 7.5
- TI-2010-03281 Cross-site request forgery (CSRF) vulnerability in Redback before 1.2.4, as used in… CVSS 2.0MEDIUM 6.8
- TI-2022-19145 Apache Archiva prior to 2.2.9 may allow the anonymous user to read arbitrary files CVSS 3.1HIGH 7.5
Sources
- CVE-2019-0213 · CVE Program
- CVE-2019-0213 · NVD
- FIRST EPSS
- GHSA-cqcf-4g4h-rghf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences