PT-2017-16651 · Apache · Apache Archiva

Publicado 2017-05-22 · Atualizado 2022-05-14 · CVE-2017-5657

Positive Technologies (AI Summary)

CVSS v3.1

8.0

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Archiva (affected versions not specified)

Description The issue concerns several REST service endpoints of Apache Archiva that are not protected against Cross Site Request Forgery (CSRF) attacks. This means a malicious site, opened in the same browser as the Archiva site, can send an HTML response that performs arbitrary actions on Archiva services with the same rights as the active Archiva session, potentially including administrator rights.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2017-5657

GHSA-HF4P-MHC8-X2GP

Produtos afetados

Apache Archiva

Referências · 11

• https://github.com/apache/archiva · Nota
• http://archiva.apache.org/security.html#CVE-2017-5657 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-5657 · Nota de Segurança
• http://securityfocus.com/bid/98570 · Nota
• https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E · Nota
• https://osv.dev/vulnerability/GHSA-hf4p-mhc8-x2gp · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5657 · Nota
• http://securitytracker.com/id/1038528 · Nota
• https://osv.dev/vulnerability/CVE-2017-5657 · Aviso do Fabricante
• https://web.archive.org/web/20211206215453/https://securitytracker.com/id/1038528 · Nota
• https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E · Nota