Unscored severity · published Apr 22, 2014
CVE-2013-2187
Cross-site scripting (XSS) vulnerability in Apache Archiva 1.2 through 1.2.2 and 1.3 before 1.3.8 allows remote attackers to inject arbitrary web script or HTML via unspecified…
–
CVSS
5.5%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Apache Archiva 1.2 through 1.2.2 and 1.3 before 1.3.8 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, related to the home page.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.5% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
Archiva · Apache
1.2; 1.2.1; 1.2.2; 1.3; 1.3.1; 1.3.2; +4 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-2187
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-2187
Patch
http://archiva.apache.org/security.html
www.securityfocus.com
http://www.securityfocus.com/archive/1/531884/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/66991
www.securitytracker.com
http://www.securitytracker.com/id/1030130
More from Archiva
9.8
CVE-2013-2251
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction:…
8.8
CVE-2016-4469
Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.3.9 and earlier allow remote attackers to hijack the authentication of administrators for requests…
8.0
CVE-2017-5657
Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks
7.5
CVE-2024-27139
** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva: a vulnerability in Apache Archiva allows an unauthenticated attacker to modify account…
7.5
CVE-2024-27138
** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva