CVE-2017-5657

Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery CSRF attacks. A malicious site opened in the same browser as the archiva site, may send an HTML response that performs arbitrary actions on archiva services, with the same rights as the active...

Cross site request forgery (csrf)

Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery CSRF attacks. A malicious site opened in the same browser as the archiva site, may send an HTML response that performs arbitrary actions on archiva services, with the same rights as the active...

CVE-2017-5657

Summary: Multiple connected sources confirm that Apache Archiva REST endpoints are vulnerable to CSRF. The underlying issue is lack of CSRF protections, allowing a malicious site loaded in the same browser as Archiva to trigger actions with the current user’s privileges (potentially admin). The r...

CVE-2017-5657

Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery CSRF attacks. A malicious site opened in the same browser as the archiva site, may send an HTML response that performs arbitrary actions on archiva services, with the same rights as the active...

Cross-Site Request Forgery (CSRF)

Apache Archiva and redback-rest-services are vulnerable to cross-site request forgery CSRF attacks.The library does not protect against CSRF attacks at several REST endpoints. This allows a malicious user to send HTML responses that can perform arbitrary actions on the archiva services via a...

Apache Archiva < 2.2.1 Multiple Vulnerabilities

Apache Archiva is prone to cross-site request forgery CSRF and cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

CVE-2016-5005

Cross-site scripting XSS vulnerability in Apache Archiva 1.3.9 and earlier allows remote authenticated administrators to inject arbitrary web script or HTML via the connector.sourceRepoId parameter to admin/addProxyConnectorcommit.action...

CVE-2016-5005

Cross-site scripting XSS vulnerability in Apache Archiva 1.3.9 and earlier allows remote authenticated administrators to inject arbitrary web script or HTML via the connector.sourceRepoId parameter to admin/addProxyConnectorcommit.action...

CVE-2016-4469

Multiple cross-site request forgery CSRF vulnerabilities in Apache Archiva 1.3.9 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 add new repository proxy connectors via the token parameter to admin/addProxyConnectorcommit.action, 2 new...

Cross site scripting

Cross-site scripting XSS vulnerability in Apache Archiva 1.3.9 and earlier allows remote authenticated administrators to inject arbitrary web script or HTML via the connector.sourceRepoId parameter to admin/addProxyConnectorcommit.action...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Apache Archiva 1.3.9 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 add new repository proxy connectors via the token parameter to admin/addProxyConnectorcommit.action, 2 new...

CVE-2016-4469

Multiple cross-site request forgery CSRF vulnerabilities in Apache Archiva 1.3.9 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 add new repository proxy connectors via the token parameter to admin/addProxyConnectorcommit.action, 2 new...

CVE-2016-5005

Cross-site scripting XSS vulnerability in Apache Archiva 1.3.9 and earlier allows remote authenticated administrators to inject arbitrary web script or HTML via the connector.sourceRepoId parameter to admin/addProxyConnectorcommit.action...

CVE-2016-4469

Multiple cross-site request forgery CSRF vulnerabilities in Apache Archiva 1.3.9 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 add new repository proxy connectors via the token parameter to admin/addProxyConnectorcommit.action, 2 new...

CVE-2016-4469

CVE-2016-4469 affects Apache Archiva up to version 1.3.9. The vulnerability consists of multiple cross-site request forgery (CSRF) flaws that allow an attacker to exploit authenticated administrator sessions to perform actions such as adding repository proxy connectors, creating new repositories,...

CVE-2016-5005

CVE-2016-5005 describes a cross-site scripting (XSS) vulnerability in Apache Archiva 1.3.9 and earlier. The issue allows remote authenticated administrators to inject arbitrary web script or HTML via the connector.sourceRepoId parameter to admin/addProxyConnector_commit.action. The vulnerability ...

Apache Archiva 1.3.9 xss 漏洞

No description provided by source...

Apache Archiva Cross-Site Request Forgery Vulnerability (CNVD-2016-04983)

Apache Archiva is a suite of software from the Apache Software Foundation in the United States for managing one or more remote stores. A cross-site request forgery vulnerability exists in Apache Archiva version 1.3.9, which can be exploited by an attacker to perform unauthorized operations...

Apache Archiva HTML Injection Vulnerability

Apache Archiva is a suite of software from the Apache Software Foundation in the United States for managing one or more remote stores. An HTML injection vulnerability in Apache Archiva version 1.3.9 can be exploited by an attacker to execute arbitrary code in an affected application, steal...

Apache Archiva 1.3.9 - Multiple Cross-Site Request Forgery Vulnerabilities

RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: Apache Archiva Vendor URL: https://archiva.apache.org Type: Cross-Site Request Forgery CWE-253 Date found: 2016-05-31 Date published: 2016-07-11 CVSSv3 Score: 5.4...