Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Archiva
(Apache)| Repositories |
Unknown: This might be proprietary software. |
| #Vulnerabilities | 20 |
| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2024-03-01 | CVE-2024-27139 | ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva: a vulnerability in Apache Archiva allows an unauthenticated attacker to modify account data, potentially leading to account takeover. This issue affects Apache Archiva: from 2.0.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects... | Archiva | N/A | ||
| 2024-03-01 | CVE-2024-27138 | ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva. Apache Archiva has a setting to disable user registration, however this restriction can be bypassed. As Apache Archiva has been retired, we do not expect to release a version of Apache Archiva that fixes this issue. You are recommended to look into migrating to a different solution, or isolate your instance from any untrusted users. NOTE: This vulnerability only affects products that are no longer... | Archiva | N/A | ||
| 2024-03-01 | CVE-2024-27140 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Archiva. This issue affects Apache Archiva: from 2.0.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. Alternatively, you could configure a HTTP proxy in front of your Archiva instance to only forward requests that... | Archiva | N/A | ||
| 2022-11-15 | CVE-2022-40308 | If anonymous read enabled, it's possible to read the database file directly without logging in. | Archiva | 7.5 | ||
| 2022-11-15 | CVE-2022-40309 | Users with write permissions to a repository can delete arbitrary directories. | Archiva | 4.3 | ||
| 2013-07-20 | CVE-2013-2251 | Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix. | Archiva, Struts, Gp5000_firmware, Gp7000f_firmware, Gp\-S_firmware, Interstage_business_process_manager_analytics, Primepower_firmware, Primergy_firmware, Sparc_firmware, Siebel_apps_\-_e\-Billing | 9.8 | ||
| 2023-03-29 | CVE-2023-28158 | Privilege escalation via stored XSS using the file upload service to upload malicious content. The issue can be exploited only by authenticated users which can create directory name to inject some XSS content and gain some privileges such admin user. | Archiva | 5.4 | ||
| 2020-06-19 | CVE-2020-9495 | Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute data from the connected LDAP server by providing special values to the login form. With certain characters it is possible to modify the LDAP filter used to query the LDAP users. By measuring the response time for the login request, arbitrary attribute data can be retrieved from LDAP user objects. | Archiva | 5.3 | ||
| 2022-05-25 | CVE-2022-29405 | In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8 | Archiva | 6.5 | ||
| 2010-12-06 | CVE-2010-3449 | Cross-site request forgery (CSRF) vulnerability in Redback before 1.2.4, as used in Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1; and Apache Continuum 1.3.6, 1.4.0, and 1.1 through 1.2.3.1; allows remote attackers to hijack the authentication of administrators for requests that modify credentials. | Archiva, Redback | N/A |