Lucene search

GitHub Advisory DatabaseGHSA-463W-HXFV-G9F6

HistoryNov 15, 2022 - 7:00 p.m.

Apache Archiva vulnerable to Sensitive Information Disclosure via anonymous user

2022-11-1519:00:52

CWE-200

CWE-862

GitHub Advisory Database

github.com

apache

archiva

sensitive data

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

47.6%

JSON

Apache Archiva prior to 2.2.9 may allow the anonymous user to read arbitrary files. If anonymous read enabled, it’s possible to read the database file directly without logging in.

Affected configurations

Vulners

Node

org.apache.archivaarchiva-commonRange<2.2.9

VendorProductVersionCPE
org.apache.archivaarchiva-common*cpe:2.3:a:org.apache.archiva:archiva-common:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
org.apache.archiva	archiva-common	*	cpe:2.3:a:org.apache.archiva:archiva-common::::::::

References

www.openwall.com/lists/oss-security/2022/11/15/2

archiva.apache.org/security.html

github.com/advisories/GHSA-463w-hxfv-g9f6

lists.apache.org/thread/x01pnn0jjsw512cscxsbxzrjmz64n4cc

nvd.nist.gov/vuln/detail/CVE-2022-40308

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

47.6%

JSON

Related for GHSA-463W-HXFV-G9F6