Apache Archiva subject to arbitrary directory deletion by users.

MEDIO 4.3CVE-2022-40309 · GHSA-xgq8-jq9w-77r5 · Published 15/11/2022 · updated 17/06/2026

In breve

CVE-2022-40309 è una vulnerabilità MEDIO (CVSS 4.3) che riguarda org.apache.archiva:archiva-common, archiva (apache).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.5%, superiore al 74.2% delle vulnerabilità.
Correzione: aggiornare a 2.2.9 o successiva.

Package	Affected versions	Patched versions
org.apache.archiva:archiva-common Maven	`< 2.2.9`	`2.2.9`
archiva apache	`< 2.2.9`	`2.2.9`

Description

Apache Archiva prior to 2.2.9 allows an authenticated user to delete arbitrary directories. Users with write permissions to a repository can delete arbitrary directories.

NVD description

Users with write permissions to a repository can delete arbitrary directories.

References

nvd.nist.gov/vuln/detail/CVE-2022-40309 · ADVISORY
apache/archiva · PACKAGE
lists.apache.org/thread/1odl4p85r96n27k577jk6ftrp19xfc27 · WEB
openwall.com/lists/oss-security/2022/11/15/3 · WEB

Altre vulnerabilità di org.apache.archiva:archiva-common

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free