CVE-2017-5657

Published: May 22, 2017Modified: May 13, 2026

8.0

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.1 / Impact: 5.9

Source: NVD

Description

Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks. A malicious site opened in the same browser as the archiva site, may send an HTML response that performs arbitrary actions on archiva services, with the same rights as the active archiva session (e.g. administrator rights).

Affected (1)

Products: Apache: Archiva

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Archiva	Up to 2.2.1

Related CWEs

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (8)

http://archiva.apache.org/security.html#CVE-2017-5657

Source: security@apache.org

PatchVendor Advisory

http://www.securityfocus.com/bid/98570

Source: security@apache.org

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1038528

Source: security@apache.org

https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E

Source: security@apache.org

http://archiva.apache.org/security.html#CVE-2017-5657

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.securityfocus.com/bid/98570

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1038528

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.