← back
CVE-2019-0214

CVE-2019-0214

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 5.1%
exploitation probability
5.1%top 8% of all CVEs
observed exploitation
nono source reports it
In Apache Archiva 2.0.0 - 2.2.3, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mechanism. Existing files can be overwritten, if the archiva run user has appropriate permission on the filesystem for the target file.
Affected products
Apache · Apache Archiva
References
http://archiva.apache.org/security.html#CVE-2019-0214http://packetstormsecurity.com/files/152684/Apache-Archiva-2.2.3-File-Write-Delete.htmlhttps://lists.apache.org/thread.html/18b670afc2f83034f47ebeb2f797c350fe60f1f2b33c95b95f467ef8%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/239349b6dd8f66cf87a70c287b03af451dea158b776d3dfc550b4f0e%40%3Cusers.maven.apache.org%3Ehttps://lists.apache.org/thread.html/5851cb0214f22ba681fb445870eeb6b01afd1fb614e45a22978d7dda%40%3Cusers.archiva.apache.org%3Ehttps://lists.apache.org/thread.html/ada0052409d8a4a8c4eb2c7fd6b9cd9423bc753d5fce87eb826662fb%40%3Cissues.archiva.apache.org%3Ehttps://seclists.org/bugtraq/2019/Apr/48http://www.openwall.com/lists/oss-security/2019/04/30/8http://www.securityfocus.com/bid/108124