CVE-2024-27140mediumCWE-79

CVE-2024-27140: falha de média gravidade em Apache Archiva

Apache Archiva: reflected XSS

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Apache Archiva+ Monitorar org.apache.archiva:archiva-common

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.4epss 1.3%
** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Archiva. This issue affects Apache Archiva: from 2.0.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. Alternatively, you could configure a HTTP proxy in front of your Archiva instance to only forward requests that do not have malicious characters in the URL. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
Apache Software Foundation · Apache Archiva
CVEs relacionadas — Apache Archiva

No mesmo produto, das mais perigosas para as menos.

CVE-2022-29405—Apache Archiva Arbitrary user password reset vulnerabilityEPSS 1.7%CVE-2022-40309MEDIUMApache Archiva prior to 2.2.9 allows an authenticated user to delete arbitrary directoriesEPSS 1.5%CVE-2024-27139HIGHApache Archiva: incorrect authentication potentially leading to account takeoverEPSS 1.3%CVE-2022-40308HIGHApache Archiva prior to 2.2.9 may allow the anonymous user to read arbitrary filesEPSS 1.3%CVE-2024-27138HIGHApache Archiva: disabling user registration is not effectiveEPSS 1.2%CVE-2023-28158MEDIUMApache Archiva privilege escalationEPSS 1.2%