# org.apache.archiva:archiva (Maven) vulnerabilities

11 known vulnerabilities (2 high, 1 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://central.sonatype.com/artifact/org.apache.archiva/archiva

## Advisories (11)

### [CVE-2024-27138](https://cve.now/CVE-2024-27138): Apache Archiva: disabling user registration is not effective

- Severity: High 7.5
- Published: Mar 1, 2024
- Affected: through 2.2.10.

### [CVE-2024-27139](https://cve.now/CVE-2024-27139): Apache Archiva: incorrect authentication potentially leading to account takeover

- Severity: High 7.5
- Published: Mar 1, 2024
- Affected: from 2.0.0, through 2.2.10.

### [CVE-2023-28158](https://cve.now/CVE-2023-28158): Apache Archiva privilege escalation

- Severity: Medium 6.5
- Published: Mar 29, 2023
- Affected: from 2.0.0, fixed in 2.2.10.

### [CVE-2022-29405](https://cve.now/CVE-2022-29405): Apache Archiva Arbitrary user password reset vulnerability

- Severity: Unrated
- Published: May 25, 2022
- Affected: fixed in 2.2.8.

### [CVE-2020-9495](https://cve.now/CVE-2020-9495): Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection.

- Severity: Unrated
- Published: Jun 19, 2020
- Affected: fixed in 2.2.5.

### [CVE-2019-0214](https://cve.now/CVE-2019-0214): In Apache Archiva 2.0.0 - 2.2.3, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload…

- Severity: Unrated
- Published: Apr 30, 2019
- Affected: from 2.2.0, fixed in 2.2.4.

### [CVE-2019-0213](https://cve.now/CVE-2019-0213): In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e.

- Severity: Unrated
- Published: Apr 30, 2019
- Affected: fixed in 2.2.4.

### [CVE-2017-5657](https://cve.now/CVE-2017-5657): Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks.

- Severity: Unrated
- Published: May 22, 2017
- Affected: fixed in 2.2.3.

### [CVE-2016-5005](https://cve.now/CVE-2016-5005): Cross-site scripting (XSS) vulnerability in Apache Archiva 1.3.9 and earlier allows remote authenticated administrators to inject…

- Severity: Unrated
- Published: Jul 28, 2016
- Affected: fixed in 2.2.1.

### [CVE-2011-0533](https://cve.now/CVE-2011-0533): Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta; and Archiva 1.3.0 through 1.3.3…

- Severity: Unrated
- Published: Feb 17, 2011
- Affected: from 1.0, fixed in 1.3.4.

### [CVE-2010-4408](https://cve.now/CVE-2010-4408): Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1 does not require entry of the…

- Severity: Unrated
- Published: Dec 6, 2010
- Affected: from 1.0, fixed in 1.3.2.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.apache.archiva:archiva
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.