Apache Archiva (Apache Software Foundation) - vulnerabilities (CVEs)

8 CVEs, 0 in the last 30 days, 3 known versions, newest CVE from 2024-03-01. Vendor: Apache Software Foundation.

CVEs of Apache Archiva

• CVE-2024-27139 - CVSS 7.5 (high), 2024-03-01: ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva: a vulnerability in Apache Archiva allows an unauthenticated attacker…
• CVE-2024-27140 - CVSS 5.4 (medium), 2024-03-01: ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Archiva. This…
• CVE-2024-27138 - CVSS 7.5 (high), 2024-03-01: ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva. Apache Archiva has a setting to disable user registration, however…
• CVE-2023-28158 - CVSS 6.5 (medium), 2023-03-29: Privilege escalation via stored XSS using the file upload service to upload malicious content. The issue can be exploited only by authenticated users which…
• CVE-2022-40309 - CVSS 4.3 (medium), 2022-11-15: Users with write permissions to a repository can delete arbitrary directories.
• CVE-2022-40308 - CVSS 7.5 (high), 2022-11-15: If anonymous read enabled, it's possible to read the database file directly without logging in.
• CVE-2022-29405 - CVSS 6.5 (medium), 2022-05-25: In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8
• CVE-2017-5657 - CVSS 8 (high), 2017-05-22: Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks. A malicious site opened in the same…