Description
In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8
Remediation
References
https://archiva.apache.org/docs/2.2.8/release-notes.html
Related Vulnerabilities
CVE-2022-43428 Vulnerability in maven package com.compuware.jenkins:compuware-topaz-for-total-test
CVE-2018-18893 Vulnerability in maven package com.hubspot.jinjava:jinjava
CVE-2020-15250 Vulnerability in maven package junit:junit
CVE-2022-42009 Vulnerability in maven package org.apache.ambari:ambari