CVE-2017-5657

CWE-352 — Cross-Site Request Forgery (CSRF)4 documents4 sources
Severity
8.0HIGH
EPSS
0.1%
top 65.33%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache ArchivaApache Software Foundation Apache Archiva
Timeline
PublishedMay 22
Latest updateMay 14

Description

Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks. A malicious site opened in the same browser as the archiva site, may send an HTML response that performs arbitrary actions on archiva services, with the same rights as the active archiva session (e.g. administrator rights).

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HExploitability: 2.1 | Impact: 5.9

Affected Packages3 packages

▶NVDapache/archiva2.2.1

Patches

Patch: archiva.apache.org ↗Patch: archiva.apache.org ↗

🔴Vulnerability Details

3
OSV
Apache Archiva vulnerable to Cross Site Request Forgery↗2022-05-14
▶
GHSA
Apache Archiva vulnerable to Cross Site Request Forgery↗2022-05-14
▶
CVEList
CVE-2017-5657: Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks↗2017-05-22
▶
CVE-2017-5657 (HIGH CVSS 8) | Several REST service endpoints of A | cvebase.io