Apache Archiva 1.3.4 Cross Site Request Forgery

`CVE-2011-1026: Apache Archiva Multiple CSRF vulnerability  
  
Severity: High  
  
Vendor:  
The Apache Software Foundation  
  
Versions Affected:  
Archiva 1.3.0 - 1.3.4  
The unsupported versions Archiva 1.0 - 1.2.2 are also affected.  
  
Description:  
An attacker can build a simple html page containing a hidden Image tag  
(eg: <img src=vulnurl width=0 height=0 />) and entice the administrator  
to access the page.  
Mitigation:  
Archiva 1.3.4 and earlier users should upgrade to 1.3.5  
  
Credit:  
This issue was discovered by Riyaz Ahemed Walikar of Microland Ltd., India  
  
References:  
http://archiva.apache.org/security.html  
  
Thanks,  
The Apache Archiva Team  
`