In short
- CVE-2010-4408 is a MEDIUM (CVSS 6.8) vulnerability affecting org.apache.archiva:archiva, archiva (apache).
- Chance of exploitation in the next 30 days (EPSS): 2.0%, higher than 80.5% of all vulnerabilities.
- Fix: update to 1.3.2 or later.
| Package | Affected versions | Patched versions |
|---|
| org.apache.archiva:archiva Maven | ≥ 1.0, < 1.3.2
| 1.3.2
|
| archiva | = 1.0= 1.0.1= 1.0.2= 1.0.3= 1.1= 1.1.1= 1.1.2= 1.1.3= 1.1.4= 1.2= 1.2.1= 1.2.2= 1.3= 1.3.1
| No fix yet |
Description
Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1 does not require entry of the administrator's password at the time of modifying a user account, which makes it easier for context-dependent attackers to gain privileges by leveraging a (1) unattended workstation or (2) cross-site request forgery (CSRF) vulnerability, a related issue to CVE-2010-3449.
NVD description
Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1 does not require entry of the administrator's password at the time of modifying a user account, which makes it easier for context-dependent attackers to gain privileges by leveraging a (1) unattended workstation or (2) cross-site request forgery (CSRF) vulnerability, a related issue to CVE-2010-3449.
More vulnerabilities in org.apache.archiva:archiva
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free