Apache Software Foundation Archiva 1.4 Milestone 1

CPE Details

Apache Software Foundation Archiva 1.4 Milestone 1
apache
archiva
1.4
2020-06-24
15h13 +00:00
2020-06-24
15h13 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:apache:archiva:1.4:milestone1:*:*:*:*:*:*

Informations

Vendor

apache

Product

archiva

Version

1.4

Update

milestone1

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2022-40308 2022-11-14 23h00 +00:00 If anonymous read enabled, it's possible to read the database file directly without logging in.
7.5
Haute
CVE-2022-40309 2022-11-14 23h00 +00:00 Users with write permissions to a repository can delete arbitrary directories.
4.3
Moyen
CVE-2022-29405 2022-05-25 05h15 +00:00 In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8
6.5
Moyen
CVE-2020-9495 2020-06-19 16h59 +00:00 Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute data from the connected LDAP server by providing special values to the login form. With certain characters it is possible to modify the LDAP filter used to query the LDAP users. By measuring the response time for the login request, arbitrary attribute data can be retrieved from LDAP user objects.
5.3
Moyen
CVE-2019-0213 2019-04-30 19h35 +00:00 In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e. the logo URL. The vulnerability is considered as minor risk, as only users with admin role can change the configuration, or the communication between the browser and the Archiva server must be compromised.
6.5
Moyen
CVE-2017-5657 2017-05-22 16h00 +00:00 Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks. A malicious site opened in the same browser as the archiva site, may send an HTML response that performs arbitrary actions on archiva services, with the same rights as the active archiva session (e.g. administrator rights).
8
Haute