CVE-2024-27140CWE-79

Apache Archiva: reflected XSS

Medium · published March 1, 2024

CVSS v3.1
5.4
EPSS
1%
Percentile
71.1
In the wild
Unconfirmed
What it is

** UNSUPPORTED WHEN ASSIGNED **

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Archiva.

This issue affects Apache Archiva: from 2.0.0.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. Alternatively, you could configure a HTTP proxy in front of your Archiva instance to only forward requests that do not have malicious characters in the URL.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01341 · 71.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-03-01T15:40Z
EPSS history
Timeline
  • 01 MAR 15:40Z
    Apache Archiva: reflected XSS
    cvelistv5