Apache Archiva: reflected XSS
Vulnerability Description
** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Archiva. This issue affects Apache Archiva: from 2.0.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. Alternatively, you could configure a HTTP proxy in front of your Archiva instance to only forward requests that do not have malicious characters in the URL. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-27140
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- sandr0 / Sandro Bauer (sandr0.xyz)
- BTullis / Ben Tullis (wikimedia.org)
- sbassett / Scott Bassett (wikimedia.org)
- L0ne1y
References
More from Apache Software Foundation
View All →Affected Vendor
Apache Software Foundation
View all reports →