Apache Archiva Arbitrary user password reset vulnerability

Vulnerability

In Apache Archiva, versions prior to 2.2.8, any registered user can reset the password for any other user without proper authorization checks. This is a privilege escalation vulnerability that affects all users of the system. [1]

Exploitation

An attacker needs a valid registered account in Archiva. Using that account, they can navigate to the password reset functionality and specify the username of any target user (including administrators). The system processes the reset request without verifying that the requester has the right to change that user's password. [1][2]

Impact

Successful exploitation allows the attacker to reset the password of any user, leading to full account takeover. This can result in unauthorized access to sensitive data, repository management, and administrative controls, compromising the entire Archiva instance. [1][2]

Mitigation

The vulnerability is fixed in Apache Archiva 2.2.8, released on 2022-05-25. Users should upgrade to this version immediately. No workarounds are available for earlier versions. [1]