Login Request a demo
Unscored severity · published Jun 2, 2011
CVE-2011-1026
Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.0 through 1.2.2, and 1.3.x before 1.3.5, allow remote attackers to hijack the authentication of…
–
CVSS
2.1%
EPSS
No
On KEV
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.0 through 1.2.2, and 1.3.x before 1.3.5, allow remote attackers to hijack the authentication of administrators.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
Archiva · Apache
1.0; 1.0.1; 1.0.2; 1.0.3; 1.1; 1.1.1; +12 more · source: NVD
Affected product
AR
Archiva
Apache
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-1026
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-1026
archiva.apache.org
http://archiva.apache.org/docs/1.3.5/release-notes.html
Vendor Advisory
http://archiva.apache.org/security.html
Exploit
http://archives.neohapsis.com/archives/fulldisclosure/2011-05/0532.html
Vendor Advisory
http://secunia.com/advisories/44693
securityreason.com
http://securityreason.com/securityalert/8266
www.securityfocus.com
http://www.securityfocus.com/archive/1/518168/100/0/threaded
More from Archiva
9.8
CVE-2013-2251
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction:…
8.8
CVE-2016-4469
Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.3.9 and earlier allow remote attackers to hijack the authentication of administrators for requests…
8.0
CVE-2017-5657
Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks
7.5
CVE-2024-27139
** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva: a vulnerability in Apache Archiva allows an unauthenticated attacker to modify account…
7.5
CVE-2024-27138
** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva