PT-2022-19580 · Apache · Apache Archiva

Published 2022-05-25 · Updated 2023-08-08 · CVE-2022-29405

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Archiva versions prior to 2.2.8

Description The issue allows any registered user to reset the password for any other user.

Recommendations For versions prior to 2.2.8, update to version 2.2.8 to resolve the issue.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2022-29405

GHSA-5HQC-X78W-3CMW

Affected Products

Apache Archiva

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-29405 · Security Note
• https://osv.dev/vulnerability/GHSA-5hqc-x78w-3cmw · Vendor Advisory
• https://archiva.apache.org/docs/2.2.8/release-notes.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-29405 · Vendor Advisory
• https://t.me/cvenotify/30684 · Telegram Post
• https://t.me/cvenotify/30690 · Telegram Post
• https://t.me/cvenotify/31150 · Telegram Post