- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 11 · 2 high, 1 medium
- Registry
- Maven Central
Advisories 11
- CVE-2024-27138High 7.5
Apache Archiva: disabling user registration is not effective
Affected: through 2.2.10.
- CVE-2024-27139High 7.5
Apache Archiva: incorrect authentication potentially leading to account takeover
Affected: from 2.0.0, through 2.2.10.
- CVE-2023-28158Medium 6.5
Apache Archiva privilege escalation
Affected: from 2.0.0, fixed in 2.2.10.
- CVE-2022-29405Unrated
Apache Archiva Arbitrary user password reset vulnerability
Affected: fixed in 2.2.8.
- CVE-2020-9495Unrated
Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection.
Affected: fixed in 2.2.5.
- CVE-2019-0214Unrated
In Apache Archiva 2.0.0 - 2.2.3, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload…
Affected: from 2.2.0, fixed in 2.2.4.
- CVE-2019-0213Unrated
In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e.
Affected: fixed in 2.2.4.
- CVE-2017-5657Unrated
Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks.
Affected: fixed in 2.2.3.
- CVE-2016-5005Unrated
Cross-site scripting (XSS) vulnerability in Apache Archiva 1.3.9 and earlier allows remote authenticated administrators to inject…
Affected: fixed in 2.2.1.
- CVE-2011-0533Unrated
Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta; and Archiva 1.3.0 through 1.3.3…
Affected: from 1.0, fixed in 1.3.4.
- CVE-2010-4408Unrated
Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1 does not require entry of the…
Affected: from 1.0, fixed in 1.3.2.