Description
In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8
Remediation
References
https://archiva.apache.org/docs/2.2.8/release-notes.html
Related Vulnerabilities
CVE-2019-12399 Vulnerability in maven package org.apache.kafka:kafka
CVE-2018-20677 Vulnerability in maven package org.webjars.npm:bootstrap-sass
CVE-2020-13920 Vulnerability in maven package org.apache.activemq:activemq-core
CVE-2019-13127 Vulnerability in npm package mxgraph
CVE-2023-49798 Vulnerability in npm package @openzeppelin/contracts