CVE-2022-40308 Apache Archiva prior to 2.2.9 may allow the anonymous user to read arbitrary files

If anonymous read enabled, it's possible to read the database file directly without logging in...

Apache Archiva 安全漏洞

Apache Archiva is a suite of software from the Apache Foundation for managing one or more remote repositories. The software provides remote Repository agents, role-based security access management, and usage reporting.A security vulnerability exists in versions of Apache Archiva prior to 2.2.9,...

Apache Archiva < 2.2.6 Multiple Log4j Vulnerabilities (Log4Shell) - Active Check

Apache Archiva is prone to multiple vulnerabilities in the Apache Log4j library. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Apache Archiva < 2.2.8 Improper Authorization Vulnerability

Apache Archiva is prone to an improper authorization vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Apache Archiva Security Feature Issue Vulnerability

Apache Archiva is a suite of software from the Apache Foundation for managing one or more remote stores. The software provides remote Repository agents, role-based security access management, and usage reporting. Apache Archiva is vulnerable to a security feature issue that can be exploited by an...

GHSA-5HQC-X78W-3CMW Missing Authorization in Apache Archiva

In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8...

Missing Authorization in Apache Archiva

In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8...

CVE-2022-29405

In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8...

CVE-2022-29405

In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8...

Default credentials

In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8...

CVE-2022-29405 Apache Archiva Arbitrary user password reset vulnerability

In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8...

CVE-2022-29405 Apache Archiva Arbitrary user password reset vulnerability

In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8...

PT-2022-19580 · Apache · Apache Archiva

Name of the Vulnerable Software and Affected Versions: Apache Archiva versions prior to 2.2.8 Description: The issue allows any registered user to reset the password for any other user. Recommendations: For versions prior to 2.2.8, update to version 2.2.8 to resolve the issue...

Apache Archiva 安全特征问题漏洞

Apache Archiva is a suite of software from the Apache USA Foundation for managing one or more remote repositories. The software provides features such as remote Repository agents, role-based secure access management, and usage reporting. Apache Archiva suffers from a security vulnerability that...

GHSA-R2PG-W96P-PCPJ ws-xmlrpc DoS Vulnerability

The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service resource consumption by decompressing a large file containing zeroes...

GHSA-5P54-JJ38-3HXJ Apache Archiva does not require entry of the administrator's password at the time of modifying a user account

Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1 does not require entry of the administrator's password at the time of modifying a user account, which makes it easier for context-dependent attackers to gain privileges by leveraging a 1 unattended...

Apache Archiva does not require entry of the administrator's password at the time of modifying a user account

Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1 does not require entry of the administrator's password at the time of modifying a user account, which makes it easier for context-dependent attackers to gain privileges by leveraging a 1 unattended...

Apache XML-RPC XXE Vulnerability

XML external entity XXE vulnerability in the Apache XML-RPC aka ws-xmlrpc library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery SSRF attacks via a crafted DTD...

GHSA-HF4P-MHC8-X2GP Apache Archiva vulnerable to Cross Site Request Forgery

Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery CSRF attacks. A malicious site opened in the same browser as the archiva site, may send an HTML response that performs arbitrary actions on archiva services, with the same rights as the active...

Apache Archiva vulnerable to Cross Site Request Forgery

Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery CSRF attacks. A malicious site opened in the same browser as the archiva site, may send an HTML response that performs arbitrary actions on archiva services, with the same rights as the active...