Description
Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta; and Archiva 1.3.0 through 1.3.3 and 1.0 through 1.22 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to the autoIncludeParameters setting for the extremecomponents table.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.archiva:archiva | >= 1.0, < 1.3.4 | 1.3.4 | GHSA-7382-fv7p-v9v3 |
| Maven | org.apache.continuum:continuum | >= 1.1, < 1.3.7 | 1.3.7 | GHSA-7382-fv7p-v9v3 |
| Maven | org.apache.continuum:continuum | 1.4.0-beta | — | GHSA-7382-fv7p-v9v3 |
References
- 70925 vdb-entry
- http://svn.apache.org/viewvc?view=revision&revision=1066056
- 46311 vdb-entry
- 43261 third-party-advisory
- http://jira.codehaus.org/browse/CONTINUUM-2604
- [continuum-users] 20110210 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability mailing-list
- ADV-2011-0373 vdb-entry
- 1025065 vdb-entry
- 20110216 [SECURITY] CVE-2011-0533: Apache Archiva cross-site scripting vulnerability mailing-list
- oval:org.mitre.oval:def:12581 vdb-entry signature
- 8091 third-party-advisory
- http://svn.apache.org/viewvc?view=revision&revision=1066053
- ADV-2011-0426 vdb-entry
- 43334 third-party-advisory
- continuum-unspec-xss(65343) vdb-entry
- 20110210 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability mailing-list
- http://continuum.apache.org/security.html
- 20110211 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability mailing-list