Apache Archiva
20 CVEs affecting Apache Archiva. Latest disclosed: 2024-03-01. Critical: 1, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2013-2251 | Critical | 9.8 | 2013-07-20 | Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or… |
CVE-2016-4469 | High | 8.8 | 2016-07-28 | Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.3.9 and earlier allow remote attackers to hijack the authentication of administr… |
CVE-2017-5657 | High | 8.0 | 2017-05-22 | Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks. A malicious site opened in the same brows… |
CVE-2024-27139 | High | 7.5 | 2024-03-01 | ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva: a vulnerability in Apache Archiva allows an unauthenticated attacker… |
CVE-2024-27138 | High | 7.5 | 2024-03-01 | ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva. Apache Archiva has a setting to disable user registration, however th… |
CVE-2022-40308 | High | 7.5 | 2022-11-15 | If anonymous read enabled, it's possible to read the database file directly without logging in. |
CVE-2023-28158 | Medium | 6.5 | 2023-03-29 | Privilege escalation via stored XSS using the file upload service to upload malicious content. The issue can be exploited only by authenticated users which can… |
CVE-2022-29405 | Medium | 6.5 | 2022-05-25 | In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8 |
CVE-2019-0214 | Medium | 6.5 | 2019-04-30 | In Apache Archiva 2.0.0 - 2.2.3, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mechanism. Existing fi… |
CVE-2019-0213 | Medium | 6.5 | 2019-04-30 | In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e. the logo URL. The vulnerability is cons… |
CVE-2024-27140 | Medium | 5.4 | 2024-03-01 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Archiva. This is… |
CVE-2020-9495 | Medium | 5.3 | 2020-06-19 | Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute data from the connected LDAP server by… |
CVE-2016-5005 | Medium | 4.8 | 2016-07-28 | Cross-site scripting (XSS) vulnerability in Apache Archiva 1.3.9 and earlier allows remote authenticated administrators to inject arbitrary web script or HTML… |
CVE-2022-40309 | Medium | 4.3 | 2022-11-15 | Users with write permissions to a repository can delete arbitrary directories. |
CVE-2013-2187 | | 2014-04-22 | Cross-site scripting (XSS) vulnerability in Apache Archiva 1.2 through 1.2.2 and 1.3 before 1.3.8 allows remote attackers to inject arbitrary web script or HTM… | |
CVE-2011-1077 | | 2011-06-02 | Multiple cross-site scripting (XSS) vulnerabilities in Apache Archiva 1.0 through 1.2.2, and 1.3.x before 1.3.5, allow remote attackers to inject arbitrary web… | |
CVE-2011-1026 | | 2011-06-02 | Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.0 through 1.2.2, and 1.3.x before 1.3.5, allow remote attackers to hijack the au… | |
CVE-2011-0533 | | 2011-02-17 | Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta; and Archiva 1.3.0 through 1.3.3 and 1.0 through 1.22 a… | |
CVE-2010-4408 | | 2010-12-06 | Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1 does not require entry of the administrator's password at the tim… | |
CVE-2010-3449 | | 2010-12-06 | Cross-site request forgery (CSRF) vulnerability in Redback before 1.2.4, as used in Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and… |