GitHub Advisoryadvisory · Maven
GHSA-cqcf-4g4h-rghf Cross-site scripting in Apache Archiva
MEDIUM
Official page ↗
- Aliases
- CVE-2019-0213
- Ecosystem
- Maven
- Packages
- org.apache.archiva:archiva
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2019-05-03
Affected packages
• Maven org.apache.archiva:archiva: < 2.2.4 → fixed in 2.2.4
Description
In Apache Archiva before 2.2.4, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mechanism. Existing files can be overwritten, if the archiva run user has appropriate permission on the filesystem for the target file.
Related
Alias · CVE (1)
- CVE-2019-0213 In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e. vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-0213 advisory
- https://lists.apache.org/thread.html/0397ddbd17b5257cc1746b31a07294a87221c5ca24e5d19d390e28f3@%3Cusers.archiva.apache.org%3E web
- https://lists.apache.org/thread.html/7bcea134c3d6fa72cdc1052922ac0914f399f63f4690b7937b80127d@%3Cannounce.apache.org%3E web
- https://lists.apache.org/thread.html/ada0052409d8a4a8c4eb2c7fd6b9cd9423bc753d5fce87eb826662fb@%3Cissues.archiva.apache.org%3E web
- https://lists.apache.org/thread.html/c358754a35473a61477f9d487870581a0dd7054ff95974628fa09f97@%3Cusers.maven.apache.org%3E web
- https://seclists.org/bugtraq/2019/Apr/47 web
- http://archiva.apache.org/security.html#CVE-2019-0213 web
- http://packetstormsecurity.com/files/152681/Apache-Archiva-2.2.3-Cross-Site-Scripting.html web
- http://www.openwall.com/lists/oss-security/2019/04/30/7 web
- http://www.securityfocus.com/bid/108123 web