CVEvulnerability
CVE-2019-0214
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2019-04-30
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.5 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.5 MEDIUM — AV:N/AC:L/Au:S/C:N/I:P/A:P
Description
In Apache Archiva 2.0.0 - 2.2.3, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mechanism. Existing files can be overwritten, if the archiva run user has appropriate permission on the filesystem for the target file.
Affected configurations
• apache archiva (>= 1.2 <= 1.3.9)
• apache archiva (>= 2.0.0 <= 2.2.3)
References
- http://archiva.apache.org/security.html#CVE-2019-0214 Vendor Advisory
- http://packetstormsecurity.com/files/152684/Apache-Archiva-2.2.3-File-Write-Delete.html Mitigation, Third Party Advisory, VDB Entry
- http://www.openwall.com/lists/oss-security/2019/04/30/8 Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/108124 Third Party Advisory, VDB Entry
- https://lists.apache.org/thread.html/18b670afc2f83034f47ebeb2f797c350fe60f1f2b33c95b95f467ef8%40%3Cannounce.apache.org%3E lists.apache.org
- https://lists.apache.org/thread.html/239349b6dd8f66cf87a70c287b03af451dea158b776d3dfc550b4f0e%40%3Cusers.maven.apache.org%3E lists.apache.org
- https://lists.apache.org/thread.html/5851cb0214f22ba681fb445870eeb6b01afd1fb614e45a22978d7dda%40%3Cusers.archiva.apache.org%3E lists.apache.org
- https://lists.apache.org/thread.html/ada0052409d8a4a8c4eb2c7fd6b9cd9423bc753d5fce87eb826662fb%40%3Cissues.archiva.apache.org%3E lists.apache.org
- https://seclists.org/bugtraq/2019/Apr/48 Mailing List, Third Party Advisory
- http://archiva.apache.org/security.html#CVE-2019-0214 Vendor Advisory
- http://packetstormsecurity.com/files/152684/Apache-Archiva-2.2.3-File-Write-Delete.html Mitigation, Third Party Advisory, VDB Entry
- http://www.openwall.com/lists/oss-security/2019/04/30/8 Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/108124 Third Party Advisory, VDB Entry
- https://lists.apache.org/thread.html/18b670afc2f83034f47ebeb2f797c350fe60f1f2b33c95b95f467ef8%40%3Cannounce.apache.org%3E lists.apache.org
- https://lists.apache.org/thread.html/239349b6dd8f66cf87a70c287b03af451dea158b776d3dfc550b4f0e%40%3Cusers.maven.apache.org%3E lists.apache.org
- https://lists.apache.org/thread.html/5851cb0214f22ba681fb445870eeb6b01afd1fb614e45a22978d7dda%40%3Cusers.archiva.apache.org%3E lists.apache.org
- https://lists.apache.org/thread.html/ada0052409d8a4a8c4eb2c7fd6b9cd9423bc753d5fce87eb826662fb%40%3Cissues.archiva.apache.org%3E lists.apache.org
- https://seclists.org/bugtraq/2019/Apr/48 Mailing List, Third Party Advisory