Approved changes feed: RSS · Atom
cpe:2.3:a:apache:archiva:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache (b0303047-b7dd-5cf8-abcc-71b7d9d80b95) |
|---|---|
| Product | Archiva (bbee34a2-efc3-51a6-a883-52d5da614833) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:apache/archiva |
purl2cpe | 2026-06-01 10:14:30.394196 |
pkg:github/apache/archiva |
purl2cpe | 2026-06-01 10:14:30.394200 |
pkg:maven/org.apache.archiva/archiva |
purl2cpe | 2026-06-01 10:14:30.394202 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-27140 |
vulnerable | 2026-06-08 06:31:27.699442 |
Apache Archiva: reflected XSS
** UNSUPPORTED WHEN ASSIGNED **
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Archiva.
This issue affects Apache Archiva: from 2.0.0.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. Alternatively, you could configure a HTTP proxy in front of your Archiva instance to only forward requests that do not have malicious characters in the URL.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Published: 2024-03-01T15:40:08.456Z
Updated: 2025-02-13T17:41:19.631Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-27139 |
vulnerable | 2026-06-08 06:31:27.698971 |
Apache Archiva: incorrect authentication potentially leading to account takeover
** UNSUPPORTED WHEN ASSIGNED **
Incorrect Authorization vulnerability in Apache Archiva: a vulnerability in Apache Archiva allows an unauthenticated attacker to modify account data, potentially leading to account takeover.
This issue affects Apache Archiva: from 2.0.0.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Published: 2024-03-01T15:40:49.893Z
Updated: 2025-04-16T20:47:27.623Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-27138 |
vulnerable | 2026-06-08 06:31:27.697278 |
Apache Archiva: disabling user registration is not effective
** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva.
Apache Archiva has a setting to disable user registration, however this restriction can be bypassed. As Apache Archiva has been retired, we do not expect to release a version of Apache Archiva that fixes this issue. You are recommended to look into migrating to a different solution, or isolate your instance from any untrusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Published: 2024-03-01T15:41:12.677Z
Updated: 2025-02-13T17:41:18.332Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-28158 |
vulnerable | 2026-06-08 06:01:09.745570 |
Apache Archiva privilege escalation
MEDIUM (6.5)
Privilege escalation via stored XSS using the file upload service to upload malicious content.
The issue can be exploited only by authenticated users which can create directory name to inject some XSS content and gain some privileges such admin user.
Published: 2023-03-29T12:21:46.932Z
Updated: 2025-02-13T16:45:40.751Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-40309 |
vulnerable | 2026-06-08 05:48:24.891505 |
Apache Archiva prior to 2.2.9 allows an authenticated user to delete arbitrary directories
Users with write permissions to a repository can delete arbitrary directories.
Published: 2022-11-15T00:00:00.000Z
Updated: 2025-04-30T16:02:30.071Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-40308 |
vulnerable | 2026-06-08 05:48:24.890822 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-29405 |
vulnerable | 2026-06-08 05:42:47.677580 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-9495 |
vulnerable | 2026-06-08 05:28:02.083694 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-0214 |
vulnerable | 2026-06-08 05:12:19.336564 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-0213 |
vulnerable | 2026-06-08 05:12:19.335972 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-5657 |
vulnerable | 2026-06-08 05:09:47.776705 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-5005 |
vulnerable | 2026-06-08 05:07:55.924920 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-4469 |
vulnerable | 2026-06-08 05:07:54.602345 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2013-2251 |
vulnerable | 2026-06-08 05:04:23.930762 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.