PT-2020-20699 · Apache · Apache Archiva

Published 2020-06-19 · Updated 2022-02-10 · CVE-2020-9495

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Archiva versions prior to 2.2.5

Description The issue allows an attacker to retrieve user attribute data from the connected LDAP server by providing special values to the login form. This is achieved by modifying the LDAP filter used to query the LDAP users with certain characters. An attacker can also retrieve arbitrary attribute data from LDAP user objects by measuring the response time for the login request.

Recommendations For versions prior to 2.2.5, update to version 2.2.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the login service to minimize the risk of exploitation. Avoid using special characters in the login form until the issue is resolved.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2020-9495

GHSA-V83P-XWM9-V4G8

Affected Products

Apache Archiva

References · 17

• 🔥 https://github.com/ggolawski/CVE-2020-9495 · Exploit
• https://osv.dev/vulnerability/CVE-2020-9495 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9495 · Security Note
• http://archiva.apache.org/security.html#CVE-2020-9495 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v83p-xwm9-v4g8 · Vendor Advisory
• https://lists.apache.org/thread.html/r576eaabe3f772c045ec832a0200252494a2ce3f188f59450dd8f9b6d%40%3Cannounce.apache.org%3E · Note
• https://lists.apache.org/thread.html/r576eaabe3f772c045ec832a0200252494a2ce3f188f59450dd8f9b6d@%3Cdev.archiva.apache.org%3E · Note
• http://openwall.com/lists/oss-security/2020/06/19/1 · Note
• https://t.me/freedomf0x/8906 · Telegram Post
• https://t.me/cybersecuritytechnologies/1506 · Telegram Post
• https://lists.apache.org/thread.html/r7ae580f700ade57b00641a70a5c639a3ba576893bbf7f9fd93bc491d%40%3Cusers.maven.apache.org%3E · Note
• https://lists.apache.org/thread.html/r576eaabe3f772c045ec832a0200252494a2ce3f188f59450dd8f9b6d%40%3Cdev.archiva.apache.org%3E · Note
• https://lists.apache.org/thread.html/r576eaabe3f772c045ec832a0200252494a2ce3f188f59450dd8f9b6d@%3Cusers.archiva.apache.org%3E · Note
• https://lists.apache.org/thread.html/r576eaabe3f772c045ec832a0200252494a2ce3f188f59450dd8f9b6d%40%3Cusers.archiva.apache.org%3E · Note
• https://lists.apache.org/thread.html/r576eaabe3f772c045ec832a0200252494a2ce3f188f59450dd8f9b6d@%3Cannounce.apache.org%3E · Note