AR
Product
Archiva
On CISA KEVExploited in the wild
20
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 5Medium 8Low 0
Watch
Add Archiva to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2013-2251 In wildKEV | 9.8 | Jul 18 | Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction:… Affected: 1.3 before 1.3.8; 1.2; 1.2.2 |
| CVE-2016-4469 | 8.8 | Jul 28 | Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.3.9 and earlier allow remote attackers to hijack the authentication of administrators for requests… Affected: through 1.3.9 |
| CVE-2017-5657 | 8.0 | May 22 | Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks Affected: through 2.2.1 |
| CVE-2024-27139 | 7.5 | Mar 1 | ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva: a vulnerability in Apache Archiva allows an unauthenticated attacker to modify account… Affected: 2.0.0 and later |
| CVE-2024-27138 | 7.5 | Mar 1 | ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva Affected: 2.0.0 and later |
| CVE-2022-40308 | 7.5 | Nov 15 | If anonymous read enabled, it's possible to read the database file directly without logging in Affected: before 2.2.9 |
| CVE-2022-29405 | 6.5 | May 25 | In Apache Archiva, any registered user can reset password for any users Affected: before 2.2.8 |
| CVE-2019-0214 | 6.5 | Apr 30 | In Apache Archiva 2.0.0 - 2.2.3, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mechanism Affected: 1.2 through 1.3.9; 2.0.0 through 2.2.3 |
| CVE-2019-0213 | 6.5 | Apr 30 | In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e Affected: before 2.2.4 |
| CVE-2024-27140 | 5.4 | Mar 1 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Archiva Affected: 2.0.0 and later |
| CVE-2023-28158 | 5.4 | Mar 29 | Privilege escalation via stored XSS using the file upload service to upload malicious content Affected: 2.0 before 2.2.10 |
| CVE-2020-9495 | 5.3 | Jun 19 | Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection Affected: before 2.2.5 |
| CVE-2016-5005 | 4.8 | Jul 28 | Cross-site scripting (XSS) vulnerability in Apache Archiva 1.3.9 and earlier allows remote authenticated administrators to inject arbitrary web script or HTML via the… Affected: through 1.3.9 |
| CVE-2022-40309 | 4.3 | Nov 15 | Users with write permissions to a repository can delete arbitrary directories Affected: before 2.2.9 |
| CVE-2013-2187 | – | Apr 22 | Cross-site scripting (XSS) vulnerability in Apache Archiva 1.2 through 1.2.2 and 1.3 before 1.3.8 allows remote attackers to inject arbitrary web script or HTML via unspecified… Affected: 1.2; 1.2.1; 1.2.2; 1.3; 1.3.1; 1.3.2; +4 more |
| CVE-2011-1077 | – | Jun 2 | Multiple cross-site scripting (XSS) vulnerabilities in Apache Archiva 1.0 through 1.2.2, and 1.3.x before 1.3.5, allow remote attackers to inject arbitrary web script or HTML via… Affected: 1.0; 1.0.1; 1.0.2; 1.0.3; 1.1; 1.1.1; +12 more |
| CVE-2011-1026 | – | Jun 2 | Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.0 through 1.2.2, and 1.3.x before 1.3.5, allow remote attackers to hijack the authentication of… Affected: 1.0; 1.0.1; 1.0.2; 1.0.3; 1.1; 1.1.1; +12 more |
| CVE-2011-0533 | – | Feb 17 | Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta; and Archiva 1.3.0 through 1.3.3 and 1.0 through 1.22 allows remote… Affected: 1.0; 1.0.1; 1.0.2; 1.0.3; 1.1; 1.1.1; +10 more |
| CVE-2010-4408 | – | Dec 6 | Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1 does not require entry of the administrator's password at the time of modifying a… Affected: 1.0; 1.0.1; 1.0.2; 1.0.3; 1.1; 1.1.1; +8 more |
| CVE-2010-3449 | – | Dec 6 | Cross-site request forgery (CSRF) vulnerability in Redback before 1.2.4, as used in Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1;… Affected: 1.0; 1.0.1; 1.0.2; 1.0.3; 1.1; 1.1.1; +8 more |
Showing 20