Moderate severityNVD Advisory· Published Mar 29, 2023· Updated Feb 13, 2025
Apache Archiva privilege escalation
CVE-2023-28158
Description
Privilege escalation via stored XSS using the file upload service to upload malicious content. The issue can be exploited only by authenticated users which can create directory name to inject some XSS content and gain some privileges such admin user.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.archiva:archivaMaven | >= 2.0.0, < 2.2.10 | 2.2.10 |
Affected products
2Patches
Vulnerability mechanics
References
8- github.com/advisories/GHSA-qf34-f43r-gv9pghsaADVISORY
- lists.apache.org/thread/8pm6d5y9cptznm0bdny3n8voovmm0dttghsavendor-advisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2023-28158ghsaADVISORY
- www.openwall.com/lists/oss-security/2023/04/18/2ghsaWEB
- github.com/apache/archiva/commit/d62e81c7e75f617cf01d2a75952a2c857758f8c4ghsaWEB
- github.com/apache/archiva/commit/e7f7e70992d361d8b7a3298ddcdf49dda2fdc842ghsaWEB
- github.com/apache/archiva/commit/ee3ee0a18977b67b6997ea8cd023816201059f96ghsaWEB
- github.com/apache/archiva/releases/tag/archiva-2.2.10ghsaWEB
News mentions
0No linked articles in our index yet.