High severity · published Jul 28, 2016
CVE-2016-4469
Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.3.9 and earlier allow remote attackers to hijack the authentication of administrators for requests…
8.8
CVSS
7.9%
EPSS
No
On KEV
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.3.9 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add new repository proxy connectors via the token parameter to admin/addProxyConnector_commit.action, (2) new repositories via the token parameter to admin/addRepository_commit.action, (3) edit existing repositories via the token parameter to admin/editRepository_commit.action, (4) add legacy artifact paths via the token parameter to admin/addLegacyArtifactPath_commit.action, (5) change the organizational appearance via the token parameter to admin/saveAppearance.action, or (6) upload new artifacts via the token parameter to upload_submit.action.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)7.9% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
Archiva · Apache
through 1.3.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-4469
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-4469
Exploit
http://packetstormsecurity.com/files/137869/Apache-Archiva-1.3.9-Cross-Site-Request-Forgery.html
seclists.org
http://seclists.org/fulldisclosure/2016/Jul/37
www.securityfocus.com
http://www.securityfocus.com/archive/1/538877/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/91703
www.securitytracker.com
http://www.securitytracker.com/id/1036475
lists.apache.org
https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
More from Archiva
9.8
CVE-2013-2251
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction:…
8.0
CVE-2017-5657
Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks
7.5
CVE-2024-27139
** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva: a vulnerability in Apache Archiva allows an unauthenticated attacker to modify account…
7.5
CVE-2024-27138
** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva
7.5
CVE-2022-40308
If anonymous read enabled, it's possible to read the database file directly without logging in