Apache
Apache Archiva: vulnerabilidades y CVE
Apache Archiva tiene 20 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 1 son críticas y 1 figuran en el catálogo de explotación activa de CISA.
CVE20
Últimos 12 meses0
Críticas1
Explotadas activamente1
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
🔴 Explotadas activamente (CISA KEV)
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2013-2251 | Crítica (9.8) | 100% | ⚠ Explotación activa | 20 jul 2013 | Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix. |
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2024-27140 | Media (5.4) | 1.3% | — | 1 mar 2024 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Archiva. This issue affects Apache Archiva: from 2.0.0. As this project is… |
| CVE-2024-27139 | Alta (7.5) | 1.3% | — | 1 mar 2024 | ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva: a vulnerability in Apache Archiva allows an unauthenticated attacker to modify account data, potentially leading to account… |
| CVE-2024-27138 | Alta (7.5) | 1.2% | — | 1 mar 2024 | ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva. Apache Archiva has a setting to disable user registration, however this restriction can be bypassed. As Apache Archiva has been… |
| CVE-2023-28158 | Media (5.4) | 1.2% | — | 29 mar 2023 | Privilege escalation via stored XSS using the file upload service to upload malicious content. The issue can be exploited only by authenticated users which can create directory name to inject some XSS content and gain… |
| CVE-2022-40309 | Media (4.3) | 1.4% | — | 15 nov 2022 | Users with write permissions to a repository can delete arbitrary directories. |
| CVE-2022-40308 | Alta (7.5) | 1.3% | — | 15 nov 2022 | If anonymous read enabled, it's possible to read the database file directly without logging in. |
| CVE-2022-29405 | Media (6.5) | 1.7% | — | 25 may 2022 | In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8 |
| CVE-2020-9495 | Media (5.3) | 8.0% | — | 19 jun 2020 | Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute data from the connected LDAP server by providing special values to the login form. With certain… |
| CVE-2019-0214 | Media (6.5) | 4.8% | — | 30 abr 2019 | In Apache Archiva 2.0.0 - 2.2.3, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mechanism. Existing files can be overwritten, if the archiva run user has… |
| CVE-2019-0213 | Media (6.5) | 4.8% | — | 30 abr 2019 | In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e. the logo URL. The vulnerability is considered as minor risk, as only users with admin role can… |
| CVE-2017-5657 | Alta (8) | 0.87% | — | 22 may 2017 | Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks. A malicious site opened in the same browser as the archiva site, may send an HTML response that… |
| CVE-2016-5005 | Media (4.8) | 4.8% | — | 28 jul 2016 | Cross-site scripting (XSS) vulnerability in Apache Archiva 1.3.9 and earlier allows remote authenticated administrators to inject arbitrary web script or HTML via the connector.sourceRepoId parameter to… |
| CVE-2016-4469 | Alta (8.8) | 7.9% | — | 28 jul 2016 | Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.3.9 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add new repository proxy… |
| CVE-2013-2187 | Media (4.3) | 5.5% | — | 22 abr 2014 | Cross-site scripting (XSS) vulnerability in Apache Archiva 1.2 through 1.2.2 and 1.3 before 1.3.8 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, related to the home page. |
| CVE-2013-2251 | Crítica (9.8) | 100% | ⚠ Explotación activa | 20 jul 2013 | Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix. |
| CVE-2011-1077 | Media (4.3) | 7.0% | — | 2 jun 2011 | Multiple cross-site scripting (XSS) vulnerabilities in Apache Archiva 1.0 through 1.2.2, and 1.3.x before 1.3.5, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2011-1026 | Media (6.8) | 2.1% | — | 2 jun 2011 | Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.0 through 1.2.2, and 1.3.x before 1.3.5, allow remote attackers to hijack the authentication of administrators. |
| CVE-2011-0533 | Media (4.3) | 4.2% | — | 17 feb 2011 | Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta; and Archiva 1.3.0 through 1.3.3 and 1.0 through 1.22 allows remote attackers to inject arbitrary web script or… |
| CVE-2010-4408 | Media (6.8) | 2.0% | — | 6 dic 2010 | Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1 does not require entry of the administrator's password at the time of modifying a user account, which makes it easier for… |
| CVE-2010-3449 | Media (6.8) | 4.8% | — | 6 dic 2010 | Cross-site request forgery (CSRF) vulnerability in Redback before 1.2.4, as used in Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1; and Apache Continuum 1.3.6, 1.4.0, and… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.