Vulnerabilities > Apache > Archiva > 2.2.1
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-03-29 | CVE-2023-28158 | Unspecified vulnerability in Apache Archiva Privilege escalation via stored XSS using the file upload service to upload malicious content. The issue can be exploited only by authenticated users which can create directory name to inject some XSS content and gain some privileges such admin user. | 5.4 |
| 2022-11-15 | CVE-2022-40308 | Unspecified vulnerability in Apache Archiva If anonymous read enabled, it's possible to read the database file directly without logging in. | 7.5 |
| 2022-11-15 | CVE-2022-40309 | Unspecified vulnerability in Apache Archiva Users with write permissions to a repository can delete arbitrary directories. | 4.3 |
| 2022-05-25 | CVE-2022-29405 | Unspecified vulnerability in Apache Archiva In Apache Archiva, any registered user can reset password for any users. | 6.5 |
| 2020-06-19 | CVE-2020-9495 | Injection vulnerability in Apache Archiva Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. | 5.3 |
| 2019-04-30 | CVE-2019-0214 | Unspecified vulnerability in Apache Archiva In Apache Archiva 2.0.0 - 2.2.3, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mechanism. | 6.5 |
| 2019-04-30 | CVE-2019-0213 | Cross-site Scripting vulnerability in Apache Archiva In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e. | 6.5 |
| 2017-05-22 | CVE-2017-5657 | Cross-Site Request Forgery (CSRF) vulnerability in Apache Archiva Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks. | 8.0 |