237 matches found
CVE-2022-40309 Apache Archiva prior to 2.2.9 allows an authenticated user to delete arbitrary directories
Users with write permissions to a repository can delete arbitrary directories...
CVE-2022-40308 Apache Archiva prior to 2.2.9 may allow the anonymous user to read arbitrary files
If anonymous read enabled, it's possible to read the database file directly without logging in...
PT-2022-25340 · Apache · Apache Archiva
Name of the Vulnerable Software and Affected Versions: Apache Archiva versions prior to 2.2.9 Description: The issue allows an anonymous user to read arbitrary files, including the database file, directly without logging in if anonymous read is enabled. Recommendations: For Apache Archiva version...
CVE-2022-40309 Apache Archiva prior to 2.2.9 allows an authenticated user to delete arbitrary directories
Users with write permissions to a repository can delete arbitrary directories...
Apache Archiva 安全漏洞
Apache Archiva is a suite of software from the Apache Foundation for managing one or more remote repositories. The software provides remote Repository agents, role-based security access management, and usage reporting.A security vulnerability exists in versions of Apache Archiva prior to 2.2.9,...
CVE-2022-40308 Apache Archiva prior to 2.2.9 may allow the anonymous user to read arbitrary files
If anonymous read enabled, it's possible to read the database file directly without logging in...
Apache Archiva 安全漏洞
Apache Archiva is a suite of software from the Apache USA Foundation for managing one or more remote repositories. The software provides features such as remote Repository agents, role-based secure access management, and usage reporting. A security vulnerability exists in Apache Archiva versions...
Apache Archiva < 2.2.6 Multiple Log4j Vulnerabilities (Log4Shell) - Active Check
Apache Archiva is prone to multiple vulnerabilities in the Apache Log4j library. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Apache Archiva < 2.2.8 Improper Authorization Vulnerability
Apache Archiva is prone to an improper authorization vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Apache Archiva Security Feature Issue Vulnerability
Apache Archiva is a suite of software from the Apache Foundation for managing one or more remote stores. The software provides remote Repository agents, role-based security access management, and usage reporting. Apache Archiva is vulnerable to a security feature issue that can be exploited by an...
Privilege Escalation
org.apache.archiva, archiva is vulnerable to improper access control. The vulnerability exists in the authenticate function in ArchivaUserManagerAuthenticator.java due to a lack of validations in the reset password field which allows an attacker to modify sensitive data in the system...
Missing Authorization in Apache Archiva
In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8...
GHSA-5HQC-X78W-3CMW Missing Authorization in Apache Archiva
In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8...
CVE-2022-29405
In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8...
CVE-2022-29405
In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8...
Default credentials
In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8...
CVE-2022-29405 Apache Archiva Arbitrary user password reset vulnerability
In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8...
CVE-2022-29405 Apache Archiva Arbitrary user password reset vulnerability
In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8...
CVE-2022-29405
CVE-2022-29405 concerns Apache Archiva. Affected: Archiva; Issue: any registered user can reset the password for any user due to improper authorization. Impact stated as password reset capability for other users. Mitigation: upgrade to Archiva 2.2.8 (fix mentioned in release notes). If details va...
PT-2022-19580 · Apache · Apache Archiva
Name of the Vulnerable Software and Affected Versions: Apache Archiva versions prior to 2.2.8 Description: The issue allows any registered user to reset the password for any other user. Recommendations: For versions prior to 2.2.8, update to version 2.2.8 to resolve the issue...