Product:

Archiva

(Apache)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 17
Date Id Summary Products Score Patch Annotated
2019-04-30 CVE-2019-0213 In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e. the logo URL. The vulnerability is considered as minor risk, as only users with admin role can change the configuration, or the communication between the browser and the Archiva server must be compromised. Archiva 6.5
2019-04-30 CVE-2019-0214 In Apache Archiva 2.0.0 - 2.2.3, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mechanism. Existing files can be overwritten, if the archiva run user has appropriate permission on the filesystem for the target file. Archiva 6.5
2020-06-19 CVE-2020-9495 Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute data from the connected LDAP server by providing special values to the login form. With certain characters it is possible to modify the LDAP filter used to query the LDAP users. By measuring the response time for the login request, arbitrary attribute data can be retrieved from LDAP user objects. Archiva 5.3
2022-05-25 CVE-2022-29405 In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8 Archiva 6.5
2023-03-29 CVE-2023-28158 Privilege escalation via stored XSS using the file upload service to upload malicious content. The issue can be exploited only by authenticated users which can create directory name to inject some XSS content and gain some privileges such admin user. Archiva 5.4
2022-11-15 CVE-2022-40308 If anonymous read enabled, it's possible to read the database file directly without logging in. Archiva 7.5
2022-11-15 CVE-2022-40309 Users with write permissions to a repository can delete arbitrary directories. Archiva 4.3
2014-04-22 CVE-2013-2187 Cross-site scripting (XSS) vulnerability in Apache Archiva 1.2 through 1.2.2 and 1.3 before 1.3.8 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, related to the home page. Archiva N/A
2011-06-02 CVE-2011-1077 Multiple cross-site scripting (XSS) vulnerabilities in Apache Archiva 1.0 through 1.2.2, and 1.3.x before 1.3.5, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Archiva N/A
2011-06-02 CVE-2011-1026 Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.0 through 1.2.2, and 1.3.x before 1.3.5, allow remote attackers to hijack the authentication of administrators. Archiva N/A