GitHub Advisoryadvisory · Maven

GHSA-463w-hxfv-g9f6 Apache Archiva vulnerable to Sensitive Information Disclosure via anonymous user

HIGH Published 2022-11-15 Modified 2022-11-22 Official page ↗

Aliases: CVE-2022-40308
Ecosystem: Maven
Packages: org.apache.archiva:archiva-common
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses: CWE-200, CWE-862
Reviewed: 2022-11-22

Affected packages

• Maven org.apache.archiva:archiva-common: < 2.2.9 → fixed in 2.2.9

Description

Apache Archiva prior to 2.2.9 may allow the anonymous user to read arbitrary files. If anonymous read enabled, it's possible to read the database file directly without logging in.

Alias · CVE (1)

CVE-2022-40308 If anonymous read enabled, it's possible to read the database file directly without logging in. vulnerability

Weakness · CWE (2)

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
CWE-862 Missing Authorization weakness

References

https://nvd.nist.gov/vuln/detail/CVE-2022-40308 advisory
https://archiva.apache.org/security.html web
https://github.com/apache/archiva package
https://lists.apache.org/thread/x01pnn0jjsw512cscxsbxzrjmz64n4cc web
http://www.openwall.com/lists/oss-security/2022/11/15/2 web