Login Request a demo
Unscored severity · published Jun 2, 2011
CVE-2011-1077
Multiple cross-site scripting (XSS) vulnerabilities in Apache Archiva 1.0 through 1.2.2, and 1.3.x before 1.3.5, allow remote attackers to inject arbitrary web script or HTML via…
–
CVSS
7%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in Apache Archiva 1.0 through 1.2.2, and 1.3.x before 1.3.5, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)7.0% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
Archiva · Apache
1.0; 1.0.1; 1.0.2; 1.0.3; 1.1; 1.1.1; +12 more · source: NVD
Affected product
AR
Archiva
Apache
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-1077
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-1077
archiva.apache.org
http://archiva.apache.org/docs/1.3.5/release-notes.html
Vendor Advisory
http://archiva.apache.org/security.html
Exploit
http://archives.neohapsis.com/archives/fulldisclosure/2011-05/0531.html
Vendor Advisory
http://secunia.com/advisories/44693
securityreason.com
http://securityreason.com/securityalert/8267
www.securityfocus.com
http://www.securityfocus.com/archive/1/518167/100/0/threaded
More from Archiva
9.8
CVE-2013-2251
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction:…
8.8
CVE-2016-4469
Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.3.9 and earlier allow remote attackers to hijack the authentication of administrators for requests…
8.0
CVE-2017-5657
Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks
7.5
CVE-2024-27139
** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva: a vulnerability in Apache Archiva allows an unauthenticated attacker to modify account…
7.5
CVE-2024-27138
** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva