PT-2016-5965 · Apache · Apache Archiva

Julien Ahrens · Published 2016-07-28 · Updated 2019-04-16 · CVE-2016-4469

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Archiva versions 1.3.9 and earlier

Description The issue allows remote attackers to hijack the authentication of administrators for various requests, including adding new repository proxy connectors via the "admin/addProxyConnector commit.action" API endpoint with the token parameter, adding new repositories via the "admin/addRepository commit.action" API endpoint with the token parameter, editing existing repositories via the "admin/editRepository commit.action" API endpoint with the token parameter, adding legacy artifact paths via the "admin/addLegacyArtifactPath commit.action" API endpoint with the token parameter, changing the organizational appearance via the "admin/saveAppearance.action" API endpoint with the token parameter, or uploading new artifacts via the "upload submit.action" API endpoint with the token parameter.

Recommendations For Apache Archiva versions 1.3.9 and earlier, consider disabling the token parameter in the affected API endpoints as a temporary workaround until a patch is available. Restrict access to the "admin/addProxyConnector commit.action", "admin/addRepository commit.action", "admin/editRepository commit.action", "admin/addLegacyArtifactPath commit.action", "admin/saveAppearance.action", and "upload submit.action" API endpoints to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2016-4469

Affected Products

Apache Archiva

References · 10

• 🔥 https://exploit-db.com/exploits/40109 · Exploit
• 🔥 http://packetstormsecurity.com/files/137869/Apache-Archiva-1.3.9-Cross-Site-Request-Forgery.html · Exploit
• https://osv.dev/vulnerability/CVE-2016-4469 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4469 · Security Note
• http://seclists.org/fulldisclosure/2016/Jul/37 · Note
• http://securityfocus.com/bid/91703 · Note
• http://securityfocus.com/archive/1/538877/100/0/threaded · Note
• http://securitytracker.com/id/1036475 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4469 · Note
• https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E · Note