Apache Archiva vulnerable to Cross Site Request Forgery

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2017-5657 · ADVISORY
• apache/archiva · PACKAGE
• lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E · WEB
• web.archive.org/web/20211206215453/https://securitytracker.com/id/1038528 · WEB
• archiva.apache.org/security.html · WEB
• securityfocus.com/bid/98570 · WEB
• securitytracker.com/id/1038528
• lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E

org.apache.archiva:archiva のその他の脆弱性

• CVE-2024-27139高 7.5** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva: a vulnerability in Apache Archiva allows an unauth…
• CVE-2024-27138高 7.5** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva. Apache Archiva has a setting to disable user regis…
• CVE-2023-28158中 5.4Privilege escalation via stored XSS using the file upload service to upload malicious content. The issue can be exploited only by authentica…
• CVE-2022-29405中 6.5In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8
• CVE-2020-9495中 5.3Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute data from the conne…