PT-2017-16651 · Apache · Apache Archiva

Published 2017-05-22 · Updated 2022-05-14 · CVE-2017-5657

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Archiva (affected versions not specified)

Description The issue concerns several REST service endpoints of Apache Archiva that are not protected against Cross Site Request Forgery (CSRF) attacks. This means a malicious site, opened in the same browser as the Archiva site, can send an HTML response that performs arbitrary actions on Archiva services with the same rights as the active Archiva session, potentially including administrator rights.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2017-5657

GHSA-HF4P-MHC8-X2GP

Affected Products

Apache Archiva

References · 11

• http://archiva.apache.org/security.html#CVE-2017-5657 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5657 · Security Note
• https://osv.dev/vulnerability/GHSA-hf4p-mhc8-x2gp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-5657 · Vendor Advisory
• https://github.com/apache/archiva · Note
• http://securityfocus.com/bid/98570 · Note
• https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5657 · Note
• http://securitytracker.com/id/1038528 · Note
• https://web.archive.org/web/20211206215453/https://securitytracker.com/id/1038528 · Note
• https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E · Note