PT-2024-21669 · Apache · Apache Archiva

Florian Hauser · Published 2024-03-01 · Updated 2025-05-28 · CVE-2024-27138

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Archiva (affected versions not specified)

Description The issue is related to an Incorrect Authorization vulnerability in Apache Archiva, where a setting to disable user registration can be bypassed. Since Apache Archiva has been retired, no fix is expected to be released for this issue. It is recommended to consider migrating to a different solution or isolating the instance from untrusted users.

Recommendations As a temporary workaround, consider isolating your Apache Archiva instance from any untrusted users. Look into migrating to a different solution to fully resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2024-27138

GHSA-RV4H-M4WC-V99W

Affected Products

Apache Archiva

References · 13

• https://osv.dev/vulnerability/CVE-2024-27138 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27138 · Security Note
• https://osv.dev/vulnerability/GHSA-rv4h-m4wc-v99w · Vendor Advisory
• https://lists.apache.org/thread/070qcpclcb3sqk1hn8j5lvzohp30k1m2 · Vendor Advisory
• https://github.com/apache/archiva · Note
• https://t.me/cvenotify/78733 · Telegram Post
• https://t.me/cvenotify/91655 · Telegram Post
• https://twitter.com/oss_security/status/1764021243504656588 · Twitter Post
• https://t.me/cvenotify/72832 · Telegram Post
• https://t.me/cvenotify/72806 · Telegram Post
• https://t.me/cvenotify/123919 · Telegram Post
• https://t.me/cvenotify/88398 · Telegram Post
• http://openwall.com/lists/oss-security/2024/03/01/4 · Note