GitHub Advisoryadvisory · Maven

GHSA-5p54-jj38-3hxj Apache Archiva does not require entry of the administrator's password at the time of modifying a user account

MEDIUM Published 2022-05-14 Modified 2025-04-12 Official page ↗
Aliases
CVE-2010-4408
Ecosystem
Maven
Packages
org.apache.archiva:archiva
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-862
Reviewed
2025-04-12

Affected packages

• Maven org.apache.archiva:archiva: >= 1.0, < 1.3.2 → fixed in 1.3.2

Description

Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1 does not require entry of the administrator's password at the time of modifying a user account, which makes it easier for context-dependent attackers to gain privileges by leveraging a (1) unattended workstation or (2) cross-site request forgery (CSRF) vulnerability, a related issue to CVE-2010-3449.

Related

Alias · CVE (1)

  • CVE-2010-4408 Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1 does not require entry of the administrator's… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References