What is CVE-2023-28158?

CVE-2023-28158 is a medium-severity vulnerability in Apache Archiva, classified under Cross-site Scripting. CVSS score: 6.5/10. Published 2023-03-29.

How severe is CVE-2023-28158?

Medium severity. CVSS v3 base score is 6.5 out of 10.

XSS in Apache Archiva

CVE-2023-28158

Privilege escalation via stored XSS using the file upload service to upload malicious content. The issue can be exploited only by authenticated users which can create directory name to inject some XSS content and gain some privileges such…

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.012 (63.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L.

Affected products

Apache Archiva
Apache Software Foundation Archiva — versions 2.0

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

security@apache.org (vendor-advisory, Mailing List, Vendor Advisory)
security@apache.org

Frequently asked questions

What is CVE-2023-28158?: CVE-2023-28158 is a medium-severity vulnerability in Apache Archiva, classified under Cross-site Scripting. CVSS score: 6.5/10. Published 2023-03-29.
How severe is CVE-2023-28158?: Medium severity. CVSS v3 base score is 6.5 out of 10.