PT-2016-5965 · Apache · Apache Archiva

Julien Ahrens · Publicado 2016-07-28 · Atualizado 2019-04-16 · CVE-2016-4469

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Archiva versions 1.3.9 and earlier

Description The issue allows remote attackers to hijack the authentication of administrators for various requests, including adding new repository proxy connectors via the "admin/addProxyConnector commit.action" API endpoint with the token parameter, adding new repositories via the "admin/addRepository commit.action" API endpoint with the token parameter, editing existing repositories via the "admin/editRepository commit.action" API endpoint with the token parameter, adding legacy artifact paths via the "admin/addLegacyArtifactPath commit.action" API endpoint with the token parameter, changing the organizational appearance via the "admin/saveAppearance.action" API endpoint with the token parameter, or uploading new artifacts via the "upload submit.action" API endpoint with the token parameter.

Recommendations For Apache Archiva versions 1.3.9 and earlier, consider disabling the token parameter in the affected API endpoints as a temporary workaround until a patch is available. Restrict access to the "admin/addProxyConnector commit.action", "admin/addRepository commit.action", "admin/editRepository commit.action", "admin/addLegacyArtifactPath commit.action", "admin/saveAppearance.action", and "upload submit.action" API endpoints to minimize the risk of exploitation.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2016-4469

Produtos afetados

Apache Archiva

Referências · 10

• 🔥 https://exploit-db.com/exploits/40109 · Exploit
• 🔥 http://packetstormsecurity.com/files/137869/Apache-Archiva-1.3.9-Cross-Site-Request-Forgery.html · Exploit
• http://seclists.org/fulldisclosure/2016/Jul/37 · Nota
• https://osv.dev/vulnerability/CVE-2016-4469 · Aviso do Fabricante
• http://securityfocus.com/bid/91703 · Nota
• http://securityfocus.com/archive/1/538877/100/0/threaded · Nota
• http://securitytracker.com/id/1036475 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-4469 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4469 · Nota
• https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E · Nota