CVE-2024-27138highCWE-863

CVE-2024-27138: falha de alta gravidade em Apache Archiva

Apache Archiva: disabling user registration is not effective

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Apache Archiva+ Monitorar org.apache.archiva:archiva

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 1.2%
** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva. Apache Archiva has a setting to disable user registration, however this restriction can be bypassed. As Apache Archiva has been retired, we do not expect to release a version of Apache Archiva that fixes this issue. You are recommended to look into migrating to a different solution, or isolate your instance from any untrusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Produtos afetados
Apache Software Foundation · Apache Archiva
CVEs relacionadas — Apache Archiva

No mesmo produto, das mais perigosas para as menos.

CVE-2022-29405—Apache Archiva Arbitrary user password reset vulnerabilityEPSS 1.7%CVE-2022-40309MEDIUMApache Archiva prior to 2.2.9 allows an authenticated user to delete arbitrary directoriesEPSS 1.5%CVE-2024-27140MEDIUMApache Archiva: reflected XSSEPSS 1.3%CVE-2024-27139HIGHApache Archiva: incorrect authentication potentially leading to account takeoverEPSS 1.3%CVE-2022-40308HIGHApache Archiva prior to 2.2.9 may allow the anonymous user to read arbitrary filesEPSS 1.3%CVE-2023-28158MEDIUMApache Archiva privilege escalationEPSS 1.2%