Vulnerabilities

TI-2024-17993 CVE-2024-27138 · GHSA-rv4h-m4wc-v99w

Apache Archiva: disabling user registration is not effective

MEDIUM 41

** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01192 Published 2024-03-01 No fix listed CWE-863

TI-2024-17994 CVE-2024-27139 · GHSA-h595-vwhc-3xwx

Apache Archiva: incorrect authentication potentially leading to account takeover

MEDIUM 42

** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva: a vulnerability in Apache Archiva allows an unauthenticated attacker to modify account data, potentially leading to account takeove…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0133 Published 2024-03-01 No fix listed CWE-863

TI-2024-17995 CVE-2024-27140 · GHSA-hp2x-6vrm-7j7v

Apache Archiva: reflected XSS

LOW 27

** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Archiva.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01341 Published 2024-03-01 No fix listed CWE-79

TI-2023-12727 CVE-2023-28158 · GHSA-qf34-f43r-gv9p

Apache Archiva privilege escalation

LOW 31

Privilege escalation via stored XSS using the file upload service to upload malicious content.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.01162 Published 2023-03-29 Fixed in 2.2.10 CWE-79

TI-2022-19146 CVE-2022-40309 · GHSA-xgq8-jq9w-77r5

Apache Archiva prior to 2.2.9 allows an authenticated user to delete arbitrary directories

LOW 23

Users with write permissions to a repository can delete arbitrary directories.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01496 Published 2022-11-15 Fixed in 2.2.9 CWE-862

TI-2022-19145 CVE-2022-40308 · GHSA-463w-hxfv-g9f6

Apache Archiva prior to 2.2.9 may allow the anonymous user to read arbitrary files

LOW 36

If anonymous read enabled, it's possible to read the database file directly without logging in.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01316 Published 2022-11-15 Fixed in 2.2.9 CWE-200

TI-2022-11877 CVE-2022-29405 · GHSA-5hqc-x78w-3cmw

Apache Archiva Arbitrary user password reset vulnerability

LOW 32

In Apache Archiva, any registered user can reset password for any users.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01724 Published 2022-05-25 Fixed in 2.2.8 CWE-732

TI-2020-07604 CVE-2020-9495 · GHSA-v83p-xwm9-v4g8

Injection in Apache Archiva

LOW 35

Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.08069 Published 2020-06-19 Fixed in 2.2.5 CWE-74

TI-2019-00187 CVE-2019-0214 · GHSA-jxgm-9f58-w4xp

Improper input validation in Apache Archiva

LOW 36

In Apache Archiva 2.0.0 - 2.2.3, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mechanism.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.04783 Published 2019-04-30 Fixed in 2.2.4 CWE-20

TI-2019-00186 CVE-2019-0213 · GHSA-cqcf-4g4h-rghf

Cross-site scripting in Apache Archiva

LOW 37

In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.04843 Published 2019-04-30 Fixed in 2.2.4 CWE-79

TI-2017-03657 CVE-2017-5657 · GHSA-hf4p-mhc8-x2gp

Cross-site request forgery in Apache Archiva

LOW 36

Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks.

CVSS 3.0HIGH 8.0 Network Low privileges User interaction EPSS 0.00869 Published 2017-05-22 Fixed in 2.2.3 CWE-352

TI-2016-04325 CVE-2016-5005 · GHSA-8jfm-rgmg-3wq2

Cross-site scripting (XSS) vulnerability in Apache Archiva 1.3.9 and earlier allows…

LOW 30

Cross-site scripting (XSS) vulnerability in Apache Archiva 1.3.9 and earlier allows remote authenticated administrators to inject arbitrary web script or HTML via the connector.sourceRepoId parameter to admin/addProxyCon…

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.04797 Published 2016-07-28 Fixed in 2.2.1 CWE-79

TI-2016-03842 CVE-2016-4469 · GHSA-hjp8-8h3r-gwg6

Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.3.9 and…

MEDIUM 49

Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.3.9 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add new repository proxy connecto…

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.07863 Published 2016-07-28 No fix listed CWE-352

TI-2013-01953 CVE-2013-2187 · GHSA-73x4-r3fj-rwhf

Cross-site scripting (XSS) vulnerability in Apache Archiva 1.2 through 1.2.2 and 1.3…

LOW 28

Cross-site scripting (XSS) vulnerability in Apache Archiva 1.2 through 1.2.2 and 1.3 before 1.3.8 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, related to the home page.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.05484 Published 2014-04-22 No fix listed CWE-79

TI-2013-02013 CVE-2013-2251 · GHSA-47qp-8v9g-39hp

Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL…

CRITICAL 100KEV

Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99998 Published 2013-07-18 Fixed in 2.3.15.1 CWE-74

TI-2011-00930 CVE-2011-1077 · GHSA-9xgm-6crh-mvqq

Multiple cross-site scripting (XSS) vulnerabilities in Apache Archiva 1.0 through 1.2.2…

LOW 30

Multiple cross-site scripting (XSS) vulnerabilities in Apache Archiva 1.0 through 1.2.2, and 1.3.x before 1.3.5, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.0698 Published 2011-06-02 No fix listed CWE-79

TI-2011-00885 CVE-2011-1026 · GHSA-mx92-qc4p-wpv8

Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.0 through…

LOW 34

Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.0 through 1.2.2, and 1.3.x before 1.3.5, allow remote attackers to hijack the authentication of administrators.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.02127 Published 2011-06-02 No fix listed CWE-352

TI-2011-00460 CVE-2011-0533 · GHSA-7382-fv7p-v9v3

Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6…

LOW 27

Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta; and Archiva 1.3.0 through 1.3.3 and 1.0 through 1.22 allows remote attackers to inject arbitrary web script or HTML…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.04198 Published 2011-02-17 Fixed in 1.3.4, 1.3.7 CWE-79

TI-2010-04141 CVE-2010-4408 · GHSA-5p54-jj38-3hxj

Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through…

LOW 34

Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1 does not require entry of the administrator's password at the time of modifying a user account, which makes it easier for cont…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01978 Published 2010-12-06 Fixed in 1.3.2 CWE-79

TI-2010-03281 CVE-2010-3449 · GHSA-c9q3-7wj8-34wx

Cross-site request forgery (CSRF) vulnerability in Redback before 1.2.4, as used in…

LOW 38

Cross-site request forgery (CSRF) vulnerability in Redback before 1.2.4, as used in Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1; and Apache Continuum 1.3.6, 1.4.0, and 1.…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.04837 Published 2010-12-06 No fix listed CWE-352

Vulnerabilities

Filters