VulnerabilityModified
CVE-2019-0214
In Apache Archiva 2.0.0 - 2.2.3, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mechanism.
MEDIUM 6.5EPSS 4.78%
Does this matter?
Lower severity and a low EPSS score (4.78%). Track it; it rarely justifies an emergency change on its own.
Description
In Apache Archiva 2.0.0 - 2.2.3, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mechanism. Existing files can be overwritten, if the archiva run user has appropriate permission on the filesystem for the target file.
- CVSS 3.0
- 6.5 MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 4.78% probability · 91th percentile
- CISA KEV
- Not listed
- Affected
- apache/archiva
- Source
- security@apache.org
References
- http://archiva.apache.org/security.html#CVE-2019-0214Vendor Advisory
- http://packetstormsecurity.com/files/152684/Apache-Archiva-2.2.3-File-Write-Delete.htmlMitigation, Third Party Advisory, VDB Entry
- http://www.openwall.com/lists/oss-security/2019/04/30/8Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/108124Third Party Advisory, VDB Entry
- https://lists.apache.org/thread.html/18b670afc2f83034f47ebeb2f797c350fe60f1f2b33c95b95f467ef8%40%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/239349b6dd8f66cf87a70c287b03af451dea158b776d3dfc550b4f0e%40%3Cusers.maven.apache.org%3E
- https://lists.apache.org/thread.html/5851cb0214f22ba681fb445870eeb6b01afd1fb614e45a22978d7dda%40%3Cusers.archiva.apache.org%3E
- https://lists.apache.org/thread.html/ada0052409d8a4a8c4eb2c7fd6b9cd9423bc753d5fce87eb826662fb%40%3Cissues.archiva.apache.org%3E
- https://seclists.org/bugtraq/2019/Apr/48Mailing List, Third Party Advisory
- http://archiva.apache.org/security.html#CVE-2019-0214Vendor Advisory
- http://packetstormsecurity.com/files/152684/Apache-Archiva-2.2.3-File-Write-Delete.htmlMitigation, Third Party Advisory, VDB Entry
- http://www.openwall.com/lists/oss-security/2019/04/30/8Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/108124Third Party Advisory, VDB Entry
- https://lists.apache.org/thread.html/18b670afc2f83034f47ebeb2f797c350fe60f1f2b33c95b95f467ef8%40%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/239349b6dd8f66cf87a70c287b03af451dea158b776d3dfc550b4f0e%40%3Cusers.maven.apache.org%3E
- https://lists.apache.org/thread.html/5851cb0214f22ba681fb445870eeb6b01afd1fb614e45a22978d7dda%40%3Cusers.archiva.apache.org%3E
- https://lists.apache.org/thread.html/ada0052409d8a4a8c4eb2c7fd6b9cd9423bc753d5fce87eb826662fb%40%3Cissues.archiva.apache.org%3E
- https://seclists.org/bugtraq/2019/Apr/48Mailing List, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.