Apache: >> Archiva >> 2.2.6 Security Vulnerabilities
Privilege escalation via stored XSS using the file upload service to upload malicious content.
The issue can be exploited only by authenticated users which can create directory name to inject some XSS content and gain some privileges such admin user.
CVSS Score
6.5
EPSS Score
0.001
Published
2023-03-29
Users with write permissions to a repository can delete arbitrary directories.
CVSS Score
4.3
EPSS Score
0.001
Published
2022-11-15
If anonymous read enabled, it's possible to read the database file directly without logging in.
CVSS Score
7.5
EPSS Score
0.002
Published
2022-11-15
In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8
CVSS Score
6.5
EPSS Score
0.003
Published
2022-05-25