PT-2010-5484 · Apache · Apache Archiva

Published 2010-12-06 · Updated 2022-05-14 · CVE-2010-4408

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Archiva versions 1.0 through 1.3.1

Description The issue allows context-dependent attackers to gain privileges more easily by leveraging either an unattended workstation or a cross-site request forgery (CSRF) vulnerability. This occurs because the system does not require the administrator's password when modifying a user account.

Recommendations For Apache Archiva versions 1.0 through 1.3.1, consider implementing additional authentication measures for user account modifications, such as requiring the administrator's password, to mitigate the risk of unauthorized privilege escalation. As a temporary workaround, restrict access to user account modification features to minimize the risk of exploitation.

Fix

Missing Authorization

XSS

Weakness Enumeration

CWE-862

CWE-79

Related Identifiers

CVE-2010-4408

GHSA-5P54-JJ38-3HXJ

Affected Products

Apache Archiva

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2010-4408 · Security Note
• https://osv.dev/vulnerability/GHSA-5p54-jj38-3hxj · Vendor Advisory
• https://github.com/apache/archiva · Note
• https://web.archive.org/web/20201209001124/http://securityfocus.com/archive/1/514937/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4408 · Note
• http://mail-archives.apache.org/mod_mbox/archiva-users/201011.mbox/ajax/%3CAANLkTimXejHAuXdoUKLN=[e-mail]%3E · Note
• http://securityfocus.com/archive/1/514937/100/0/threaded · Note
• http://mail-archives.apache.org/mod_mbox/archiva-users/201011.mbox/ajax/%3CAANLkTimXejHAuXdoUKLN=GkNty1_XnRCbv0YA0T2cS_2%40mail.gmail.com%3E · Note
• http://archiva.apache.org/security.html · Note