GitHub Advisoryadvisory · Maven

GHSA-xgq8-jq9w-77r5 Apache Archiva subject to arbitrary directory deletion by users.

MEDIUM Published 2022-11-15 Modified 2022-11-22 Official page ↗
Aliases
CVE-2022-40309
Ecosystem
Maven
Packages
org.apache.archiva:archiva-common
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-862
Reviewed
2022-11-22

Affected packages

• Maven org.apache.archiva:archiva-common: < 2.2.9 → fixed in 2.2.9

Description

Apache Archiva prior to 2.2.9 allows an authenticated user to delete arbitrary directories. Users with write permissions to a repository can delete arbitrary directories.

Related

Alias · CVE (1)

  • CVE-2022-40309 Users with write permissions to a repository can delete arbitrary directories. vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References