vulnwire
8.0high

CVE-2017-5657

Apache Archiva vulnerable to Cross Site Request Forgery

Also known as GHSA-hf4p-mhc8-x2gp

Published 9 y ago · modified 4 mo ago · JSON

CVSS
8.0
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.9%
percentile 59%
Public exploits
0
none known

Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks. A malicious site opened in the same browser as the archiva site, may send an HTML response that performs arbitrary actions on archiva services, with the same rights as the active archiva session (e.g. administrator rights).

Exploit prediction (EPSS)

0.87% probability of exploitation in the next 30 days, higher than 59% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.08.0CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
NVD2.06.0AV:N/AC:M/Au:S/C:P/I:P/A:P
GitHub3.08.0CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.archiva:archiva
<2.2.3
2.2.3

Affected products

  • Apache Software Foundation Apache Archiva

Classification

Weakness

References

  • archiva.apache.org /security.html#CVE-2017-5657 · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/98570 · vdb-entry, x_refsource_BID, x_transferred
  • securitytracker.com /id/1038528 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • lists.apache.org /thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar. · mailing-list, x_refsource_MLIST, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2017-5657 · advisory
  • github.com /apache/archiva · package
  • lists.apache.org /thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.ap · web
  • web.archive.org /web/20211206215453/https://securitytracker.com/id/1038528 · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.