Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS00NjN3LWh4ZnYtZzlmNs4AAv4r

Apache Archiva vulnerable to Sensitive Information Disclosure via anonymous user

Apache Archiva prior to 2.2.9 may allow the anonymous user to read arbitrary files. If anonymous read enabled, it's possible to read the database file directly without logging in.

Permalink: https://github.com/advisories/GHSA-463w-hxfv-g9f6
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00NjN3LWh4ZnYtZzlmNs4AAv4r
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 1 year ago
Updated: 10 months ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Identifiers: GHSA-463w-hxfv-g9f6, CVE-2022-40308
References:

• https://nvd.nist.gov/vuln/detail/CVE-2022-40308
• https://lists.apache.org/thread/x01pnn0jjsw512cscxsbxzrjmz64n4cc
• http://www.openwall.com/lists/oss-security/2022/11/15/2
• https://archiva.apache.org/security.html
• https://github.com/advisories/GHSA-463w-hxfv-g9f6

Affected Packages