Description
In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Archiva | 2.2 – ≤ 2.2.7 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.archiva:archiva | < 2.2.8 | 2.2.8 | GHSA-5hqc-x78w-3cmw |