CVE-2019-0214
In Apache Archiva 2.0.0 - 2.2.3, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mechanism.
Does this matter?
Lower severity and a low EPSS score (4.78%). Track it; it rarely justifies an emergency change on its own.
Description
In Apache Archiva 2.0.0 - 2.2.3, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mechanism. Existing files can be overwritten, if the archiva run user has appropriate permission on the filesystem for the target file.
- CVSS 3.0
- 6.5 MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 4.78% probability · 92th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Affected
- apache/archiva
- Source
- security@apache.org
EPSS 4.8% since 27 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- http://archiva.apache.org/security.html#CVE-2019-0214Vendor Advisory
- http://packetstormsecurity.com/files/152684/Apache-Archiva-2.2.3-File-Write-Delete.htmlMitigation, Third Party Advisory, VDB Entry
- http://www.openwall.com/lists/oss-security/2019/04/30/8Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/108124Third Party Advisory, VDB Entry
- https://lists.apache.org/thread.html/18b670afc2f83034f47ebeb2f797c350fe60f1f2b33c95b95f467ef8%40%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/239349b6dd8f66cf87a70c287b03af451dea158b776d3dfc550b4f0e%40%3Cusers.maven.apache.org%3E
- https://lists.apache.org/thread.html/5851cb0214f22ba681fb445870eeb6b01afd1fb614e45a22978d7dda%40%3Cusers.archiva.apache.org%3E
- https://lists.apache.org/thread.html/ada0052409d8a4a8c4eb2c7fd6b9cd9423bc753d5fce87eb826662fb%40%3Cissues.archiva.apache.org%3E
- https://seclists.org/bugtraq/2019/Apr/48Mailing List, Third Party Advisory
- http://archiva.apache.org/security.html#CVE-2019-0214Vendor Advisory
- http://packetstormsecurity.com/files/152684/Apache-Archiva-2.2.3-File-Write-Delete.htmlMitigation, Third Party Advisory, VDB Entry
- http://www.openwall.com/lists/oss-security/2019/04/30/8Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/108124Third Party Advisory, VDB Entry
- https://lists.apache.org/thread.html/18b670afc2f83034f47ebeb2f797c350fe60f1f2b33c95b95f467ef8%40%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/239349b6dd8f66cf87a70c287b03af451dea158b776d3dfc550b4f0e%40%3Cusers.maven.apache.org%3E
- https://lists.apache.org/thread.html/5851cb0214f22ba681fb445870eeb6b01afd1fb614e45a22978d7dda%40%3Cusers.archiva.apache.org%3E
- https://lists.apache.org/thread.html/ada0052409d8a4a8c4eb2c7fd6b9cd9423bc753d5fce87eb826662fb%40%3Cissues.archiva.apache.org%3E
- https://seclists.org/bugtraq/2019/Apr/48Mailing List, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.