Apache

Archiva

20 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.4

CVE-2024-27140

  • EPSS 2.27%
  • Veröffentlicht 01.03.2024 16:15:46
  • Zuletzt bearbeitet 28.05.2025 19:54:39

** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Archiva. This issue affects Apache Archiva: from 2.0.0. As this project is retired, we do not plan to rele...

7.5

CVE-2024-27139

  • EPSS 0.42%
  • Veröffentlicht 01.03.2024 16:15:46
  • Zuletzt bearbeitet 28.05.2025 19:54:51

** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva: a vulnerability in Apache Archiva allows an unauthenticated attacker to modify account data, potentially leading to account takeover. This issue affects Apache...

7.5

CVE-2024-27138

  • EPSS 0.2%
  • Veröffentlicht 01.03.2024 16:15:45
  • Zuletzt bearbeitet 28.05.2025 19:55:00

** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva. Apache Archiva has a setting to disable user registration, however this restriction can be bypassed. As Apache Archiva has been retired, we do not expect to rel...

5.4

CVE-2023-28158

  • EPSS 0.13%
  • Veröffentlicht 29.03.2023 13:15:08
  • Zuletzt bearbeitet 13.02.2025 17:16:14

Privilege escalation via stored XSS using the file upload service to upload malicious content. The issue can be exploited only by authenticated users which can create directory name to inject some XSS content and gain some privileges such admin user.

4.3

CVE-2022-40309

  • EPSS 0.3%
  • Veröffentlicht 15.11.2022 13:15:11
  • Zuletzt bearbeitet 30.04.2025 16:15:26

Users with write permissions to a repository can delete arbitrary directories.

7.5

CVE-2022-40308

  • EPSS 0.38%
  • Veröffentlicht 15.11.2022 13:15:10
  • Zuletzt bearbeitet 30.04.2025 16:15:26

If anonymous read enabled, it's possible to read the database file directly without logging in.

6.5

CVE-2022-29405

  • EPSS 1.44%
  • Veröffentlicht 25.05.2022 08:15:12
  • Zuletzt bearbeitet 21.11.2024 06:59:01

In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8

5.3

CVE-2020-9495

  • EPSS 27.49%
  • Veröffentlicht 19.06.2020 19:15:12
  • Zuletzt bearbeitet 21.11.2024 05:40:46

Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute data from the connected LDAP server by providing special values to the login form. With certain characters it is possible to modi...

6.5

CVE-2019-0214

  • EPSS 1.74%
  • Veröffentlicht 30.04.2019 22:29:01
  • Zuletzt bearbeitet 21.11.2024 04:16:30

In Apache Archiva 2.0.0 - 2.2.3, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mechanism. Existing files can be overwritten, if the archiva run user has appropriate permission on the filesyste...

6.5

CVE-2019-0213

  • EPSS 0.61%
  • Veröffentlicht 30.04.2019 22:29:00
  • Zuletzt bearbeitet 21.11.2024 04:16:30

In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e. the logo URL. The vulnerability is considered as minor risk, as only users with admin role can change the configuration, or the co...