PT-2019-11194 · Apache · Apache Archiva

Martin · Published 2019-04-30 · Updated 2020-08-24 · CVE-2019-0213

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Apache Archiva versions prior to 2.2.4

Description: The issue allows storing malicious XSS code in central configuration entries, such as the logo URL, which can be done by users with an admin role. Additionally, it is possible to write files to the Archiva server at arbitrary locations using the artifact upload mechanism, potentially overwriting existing files if the Archiva run user has the necessary filesystem permissions.

Recommendations: For versions prior to 2.2.4, update to version 2.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the configuration entries and the artifact upload mechanism to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-0213

GHSA-CQCF-4G4H-RGHF

Affected Products

Apache Archiva

References · 17

• http://archiva.apache.org/security.html#CVE-2019-0213 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cqcf-4g4h-rghf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0213 · Security Note
• https://osv.dev/vulnerability/CVE-2019-0213 · Vendor Advisory
• https://lists.apache.org/thread.html/0397ddbd17b5257cc1746b31a07294a87221c5ca24e5d19d390e28f3@%3Cusers.archiva.apache.org%3E · Note
• https://lists.apache.org/thread.html/c358754a35473a61477f9d487870581a0dd7054ff95974628fa09f97@%3Cusers.maven.apache.org%3E · Note
• https://lists.apache.org/thread.html/c358754a35473a61477f9d487870581a0dd7054ff95974628fa09f97%40%3Cusers.maven.apache.org%3E · Note
• http://openwall.com/lists/oss-security/2019/04/30/7 · Note
• https://seclists.org/bugtraq/2019/Apr/47 · Note
• https://lists.apache.org/thread.html/ada0052409d8a4a8c4eb2c7fd6b9cd9423bc753d5fce87eb826662fb%40%3Cissues.archiva.apache.org%3E · Note
• https://lists.apache.org/thread.html/ada0052409d8a4a8c4eb2c7fd6b9cd9423bc753d5fce87eb826662fb@%3Cissues.archiva.apache.org%3E · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0213 · Note
• https://lists.apache.org/thread.html/7bcea134c3d6fa72cdc1052922ac0914f399f63f4690b7937b80127d%40%3Cannounce.apache.org%3E · Note
• https://lists.apache.org/thread.html/7bcea134c3d6fa72cdc1052922ac0914f399f63f4690b7937b80127d@%3Cannounce.apache.org%3E · Note
• http://packetstormsecurity.com/files/152681/Apache-Archiva-2.2.3-Cross-Site-Scripting.html · Note