CVE-2017-5657

Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery CSRF attacks. A malicious site opened in the same browser as the archiva site, may send an HTML response that performs arbitrary actions on archiva services, with the same rights as the active...

CVE-2017-5657

Summary: Multiple connected sources confirm that Apache Archiva REST endpoints are vulnerable to CSRF. The underlying issue is lack of CSRF protections, allowing a malicious site loaded in the same browser as Archiva to trigger actions with the current user’s privileges (potentially admin). The r...