CVE-2020-9495

CWE-744 documents4 sources
Severity
5.3MEDIUM
EPSS
27.5%
top 3.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Apache Archiva
Timeline
PublishedJun 19
Latest updateFeb 10

Description

Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute data from the connected LDAP server by providing special values to the login form. With certain characters it is possible to modify the LDAP filter used to query the LDAP users. By measuring the response time for the login request, arbitrary attribute data can be retrieved from LDAP user objects.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages3 packages

▶NVDapache/archiva< 2.2.5
▶CVEListV5apache_archivaApache Archiva 2.2.4 and below

🔴Vulnerability Details

3
GHSA
Injection in Apache Archiva↗2022-02-10
▶
OSV
Injection in Apache Archiva↗2022-02-10
▶
CVEList
CVE-2020-9495: Apache Archiva login service before 2↗2020-06-19
▶
CVE-2020-9495 (MEDIUM CVSS 5.3) | Apache Archiva login service before | cvebase.io