Apache Apache Archiva
10 CVEs affecting Apache Apache Archiva. Latest disclosed: 2024-03-01. Critical: 0, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-5657 | High | 8.0 | 2017-05-22 | Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks. A malicious site opened in the same brows… |
CVE-2024-27139 | High | 7.5 | 2024-03-01 | ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva: a vulnerability in Apache Archiva allows an unauthenticated attacker… |
CVE-2024-27138 | High | 7.5 | 2024-03-01 | ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva. Apache Archiva has a setting to disable user registration, however th… |
CVE-2022-40308 | High | 7.5 | 2022-11-15 | If anonymous read enabled, it's possible to read the database file directly without logging in. |
CVE-2023-28158 | Medium | 6.5 | 2023-03-29 | Privilege escalation via stored XSS using the file upload service to upload malicious content. The issue can be exploited only by authenticated users which can… |
CVE-2022-29405 | Medium | 6.5 | 2022-05-25 | In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8 |
CVE-2019-0214 | Medium | 6.5 | 2019-04-30 | In Apache Archiva 2.0.0 - 2.2.3, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mechanism. Existing fi… |
CVE-2019-0213 | Medium | 6.5 | 2019-04-30 | In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e. the logo URL. The vulnerability is cons… |
CVE-2024-27140 | Medium | 5.4 | 2024-03-01 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Archiva. This is… |
CVE-2022-40309 | Medium | 4.3 | 2022-11-15 | Users with write permissions to a repository can delete arbitrary directories. |