CVE-2017-5657
High
Description
Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks. A malicious site opened in the same browser as the archiva site, may send an HTML response that performs arbitrary actions on archiva services, with the same rights as the active archiva session (e.g. administrator rights).
SeverityHigh
CVSS8.0
Exploit probability—
Product
Apache Archiva
PublishedMay 22, 2017
First seenMay 22, 2017
How to fix
Update
- org.apache.archiva:archiva2.2.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache archiva | v ≤ 2.2.1 | — |
| org.apache.archiva:archivaMaven | v < 2.2.3 | 2.2.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.