Improper input validation in Apache Archiva
Priority LOW 36CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.
Summary
In Apache Archiva 2.0.0 - 2.2.3, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mechanism. Existing files can be overwritten, if the archiva run user has appropriate permission on the filesystem for the target file.
Why it matters now
EPSS 0.04783 91st percentileScored 2026-11-07
Fix Fixed org.apache.archiva:archiva (Maven): 2.2.4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Archiva | All versions prior to version 2.2.4 | — | No fix listed | CNA |
| — | org.apache.archiva:archiva (Maven) | 2.2.0 to before 2.2.4 | 2.2.4 | Patch available | GHSA-jxgm-9f58-w4xp |
- Apache Archiva VendorApache Affected All versions prior to version 2.2.4 Fixed in — No fix listed CNA
- org.apache.archiva:archiva (Maven) Vendor— Affected 2.2.0 to before 2.2.4 Fixed in 2.2.4 Patch available GHSA-jxgm-9f58-w4xp
Remediation
- Fix · GHSA-jxgm-9f58-w4xp org.apache.archiva:archiva (Maven) Fixed in 2.2.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2019-0214
- 2026-10-03 Alias added: GHSA-jxgm-9f58-w4xp
References
Advisory 5
- 20190430 [SECURITY] CVE-2019-0214: Apache Archiva arbitrary file write and delete on the server
- [oss-security] 20190430 [SECURITY] CVE-2019-0214: Apache Archiva arbitrary file write and delete on the server
- http://packetstormsecurity.com/files/152684/Apache-Archiva-2.2.3-File-Write-Delete.html
- http://archiva.apache.org/security.html#CVE-2019-0214
- https://nvd.nist.gov/vuln/detail/CVE-2019-0214
Other 8
- [maven-users] 20190430 [SECURITY] CVE-2019-0214: Apache Archiva arbitrary file write and delete on the server
- [archiva-users] 20190430 [SECURITY] CVE-2019-0214: Apache Archiva arbitrary file write and delete on the server
- [archiva-issues] 20190501 [jira] [Created] (MRM-1987) Port security fixes for 2.2.4 to 3.0.0
- [announce] 20190430 [SECURITY] CVE-2019-0214: Apache Archiva arbitrary file write and delete on the server
- https://lists.apache.org/thread.html/18b670afc2f83034f47ebeb2f797c350fe60f1f2b33c95b95f467ef8@%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/239349b6dd8f66cf87a70c287b03af451dea158b776d3dfc550b4f0e@%3Cusers.maven.apache.org%3E
- https://lists.apache.org/thread.html/5851cb0214f22ba681fb445870eeb6b01afd1fb614e45a22978d7dda@%3Cusers.archiva.apache.org%3E
- https://lists.apache.org/thread.html/ada0052409d8a4a8c4eb2c7fd6b9cd9423bc753d5fce87eb826662fb@%3Cissues.archiva.apache.org%3E
More Apache Archiva vulnerabilities
- TI-2013-02013 Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL… KEVCVSS 3.1CRITICAL 9.8
- TI-2016-03842 Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.3.9 and… CVSS 3.0HIGH 8.8
- TI-2024-17994 Apache Archiva: incorrect authentication potentially leading to account takeover CVSS 3.1HIGH 7.5
- TI-2024-17993 Apache Archiva: disabling user registration is not effective CVSS 3.1HIGH 7.5
- TI-2010-03281 Cross-site request forgery (CSRF) vulnerability in Redback before 1.2.4, as used in… CVSS 2.0MEDIUM 6.8
- TI-2019-00186 Cross-site scripting in Apache Archiva CVSS 3.0MEDIUM 6.5
Sources
- CVE-2019-0214 · CVE Program
- CVE-2019-0214 · NVD
- FIRST EPSS
- GHSA-jxgm-9f58-w4xp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences