CVE-2023-28158CWE-79
Apache Archiva privilege escalation
Medium · published March 29, 2023
What it is
Privilege escalation via stored XSS using the file upload service to upload malicious content.
The issue can be exploited only by authenticated users which can create directory name to inject some XSS content and gain some privileges such admin user.
The record
Technical detail
- CVSS v3.1
- 6.5 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
- CVSS v4.0
- Not supplied
- EPSS
- 0.01162 · 66.9th percentile
- Weakness
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Published
- 2023-03-29T12:21Z
EPSS history
Timeline