PT-2019-11195 · Apache · Apache Archiva

Martin · Publicado 2019-04-30 · Atualizado 2021-07-21 · CVE-2019-0214

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Apache Archiva versions 2.0.0 through 2.2.3

Description: The issue allows writing files to the Archiva server at arbitrary locations using the artifact upload mechanism. It is also possible to overwrite existing files if the Archiva run user has the appropriate permission on the filesystem for the target file.

Recommendations: For Apache Archiva versions 2.0.0 through 2.2.3, consider restricting the artifact upload mechanism to prevent writing files to arbitrary locations until a patch is available. As a temporary workaround, review and restrict file system permissions for the Archiva run user to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2019-0214

GHSA-JXGM-9F58-W4XP

Produtos afetados

Apache Archiva

Referências · 17

• https://lists.apache.org/thread.html/5851cb0214f22ba681fb445870eeb6b01afd1fb614e45a22978d7dda%40%3Cusers.archiva.apache.org%3E · Nota
• http://securityfocus.com/bid/108124 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-0214 · Nota de Segurança
• https://lists.apache.org/thread.html/ada0052409d8a4a8c4eb2c7fd6b9cd9423bc753d5fce87eb826662fb%40%3Cissues.archiva.apache.org%3E · Nota
• https://lists.apache.org/thread.html/5851cb0214f22ba681fb445870eeb6b01afd1fb614e45a22978d7dda@%3Cusers.archiva.apache.org%3E · Nota
• https://lists.apache.org/thread.html/18b670afc2f83034f47ebeb2f797c350fe60f1f2b33c95b95f467ef8@%3Cannounce.apache.org%3E · Nota
• http://archiva.apache.org/security.html#CVE-2019-0214 · Aviso do Fabricante
• http://packetstormsecurity.com/files/152684/Apache-Archiva-2.2.3-File-Write-Delete.html · Nota
• http://openwall.com/lists/oss-security/2019/04/30/8 · Nota
• https://osv.dev/vulnerability/CVE-2019-0214 · Aviso do Fabricante
• https://lists.apache.org/thread.html/239349b6dd8f66cf87a70c287b03af451dea158b776d3dfc550b4f0e%40%3Cusers.maven.apache.org%3E · Nota
• https://lists.apache.org/thread.html/239349b6dd8f66cf87a70c287b03af451dea158b776d3dfc550b4f0e@%3Cusers.maven.apache.org%3E · Nota
• https://lists.apache.org/thread.html/ada0052409d8a4a8c4eb2c7fd6b9cd9423bc753d5fce87eb826662fb@%3Cissues.archiva.apache.org%3E · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0214 · Nota
• https://lists.apache.org/thread.html/18b670afc2f83034f47ebeb2f797c350fe60f1f2b33c95b95f467ef8%40%3Cannounce.apache.org%3E · Nota