CVE-2023-28158CWE-79

Apache Archiva privilege escalation

Medium · published March 29, 2023

CVSS v3.1
6.5
EPSS
1%
Percentile
66.9
In the wild
Unconfirmed
What it is

Privilege escalation via stored XSS using the file upload service to upload malicious content.

The issue can be exploited only by authenticated users which can create directory name to inject some XSS content and gain some privileges such admin user.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.01162 · 66.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2023-03-29T12:21Z
EPSS history
Timeline
  • 29 MAR 12:21Z
    Apache Archiva privilege escalation
    cvelistv5