Summary
Apache Archiva is prone to a cross-site request-forgery vulnerability.
Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application. Other attacks are also possible.
The following versions are affected:
Archiva versions 1.0 through 1.0.3
Archiva versions 1.1 through 1.1.4
Archiva versions 1.2 through 1.2.2
Archiva versions 1.3 through 1.3.1
Solution
Updates are available. Please see the reference for more details.
References
Severity
Classification
-
CVE CVE-2010-3449, CVE-2010-4408 -
CVSS Base Score: 6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P
Related Vulnerabilities
- Allegro RomPager HTTP Referer Header Cross Site Scripting Vulnerability
- Apache Subversion Module Metadata Accessible
- Apache Tomcat 'sendfile' Request Attributes Information Disclosure Vulnerability
- @Mail 'MailType' Parameter Cross Site Scripting Vulnerability
- Adobe JRun Management Console Multiple Vulnerabilities