Description
In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8
Remediation
References
https://archiva.apache.org/docs/2.2.8/release-notes.html
Related Vulnerabilities
CVE-2019-0193 Vulnerability in maven package org.apache.solr:solr-core
CVE-2017-15697 Vulnerability in maven package org.apache.nifi:nifi-web-error
CVE-2019-10453 Vulnerability in maven package org.jenkins-ci.plugins:delphix
CVE-2019-20174 Vulnerability in npm package auth0-lock
CVE-2020-2142 Vulnerability in maven package org.jenkins-ci.plugins:p4