PT-2010-5484 · Apache · Apache Archiva

Publicado 2010-12-06 · Atualizado 2022-05-14 · CVE-2010-4408

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Archiva versions 1.0 through 1.3.1

Description The issue allows context-dependent attackers to gain privileges more easily by leveraging either an unattended workstation or a cross-site request forgery (CSRF) vulnerability. This occurs because the system does not require the administrator's password when modifying a user account.

Recommendations For Apache Archiva versions 1.0 through 1.3.1, consider implementing additional authentication measures for user account modifications, such as requiring the administrator's password, to mitigate the risk of unauthorized privilege escalation. As a temporary workaround, restrict access to user account modification features to minimize the risk of exploitation.

Correção

Missing Authorization

XSS

Enumeração de Fraquezas

CWE-862

CWE-79

Identificadores relacionados

CVE-2010-4408

GHSA-5P54-JJ38-3HXJ

Produtos afetados

Apache Archiva

Referências · 9

• https://github.com/apache/archiva · Nota
• https://web.archive.org/web/20201209001124/http://securityfocus.com/archive/1/514937/100/0/threaded · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4408 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-4408 · Nota de Segurança
• http://mail-archives.apache.org/mod_mbox/archiva-users/201011.mbox/ajax/%3CAANLkTimXejHAuXdoUKLN=[e-mail]%3E · Nota
• http://securityfocus.com/archive/1/514937/100/0/threaded · Nota
• http://mail-archives.apache.org/mod_mbox/archiva-users/201011.mbox/ajax/%3CAANLkTimXejHAuXdoUKLN=GkNty1_XnRCbv0YA0T2cS_2%40mail.gmail.com%3E · Nota
• http://archiva.apache.org/security.html · Nota
• https://osv.dev/vulnerability/GHSA-5p54-jj38-3hxj · Aviso do Fabricante