CVE-2024-27138highCWE-863

CVE-2024-27138: fallo de gravedad alta en Apache Archiva

Apache Archiva: disabling user registration is not effective

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Apache Archiva+ Monitorear org.apache.archiva:archiva

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 1.2%
** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva. Apache Archiva has a setting to disable user registration, however this restriction can be bypassed. As Apache Archiva has been retired, we do not expect to release a version of Apache Archiva that fixes this issue. You are recommended to look into migrating to a different solution, or isolate your instance from any untrusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Productos afectados
Apache Software Foundation · Apache Archiva
CVEs relacionadas — Apache Archiva

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-29405—Apache Archiva Arbitrary user password reset vulnerabilityEPSS 1.7%CVE-2022-40309MEDIUMApache Archiva prior to 2.2.9 allows an authenticated user to delete arbitrary directoriesEPSS 1.5%CVE-2024-27140MEDIUMApache Archiva: reflected XSSEPSS 1.3%CVE-2024-27139HIGHApache Archiva: incorrect authentication potentially leading to account takeoverEPSS 1.3%CVE-2022-40308HIGHApache Archiva prior to 2.2.9 may allow the anonymous user to read arbitrary filesEPSS 1.3%CVE-2023-28158MEDIUMApache Archiva privilege escalationEPSS 1.2%