Apache Archiva

4 results · Clear filters · Feed

• Medium 5.4
  CVE-2024-27140

  Apache Archiva: reflected XSS

  ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Archiva. This issue affects Apache Archiva: from 2.0.0. As this project is retired, we do not plan to release a versio…

  Apache Software Foundation Apache Archiva org.apache.archiva:archiva-common Maven
  Mar 1, 2024
• Medium 6.5
  CVE-2023-28158

  Apache Archiva privilege escalation

  Privilege escalation via stored XSS using the file upload service to upload malicious content. The issue can be exploited only by authenticated users which can create directory name to inject some XSS content and gain some privileges such admin user.

  Apache Software Foundation Apache Archiva org.apache.archiva:archiva Maven
  Mar 29, 2023
• Medium 4.3
  CVE-2022-40309

  Apache Archiva prior to 2.2.9 allows an authenticated user to delete arbitrary directories

  Users with write permissions to a repository can delete arbitrary directories.

  Apache Software Foundation Apache Archiva org.apache.archiva:archiva-common Maven
  Nov 15, 2022
• Medium 6.5
  CVE-2022-29405

  Apache Archiva Arbitrary user password reset vulnerability

  In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8

  Apache Software Foundation Apache Archiva org.apache.archiva:archiva Maven
  May 25, 2022