Medium severity6.5NVD Advisory· Published Mar 29, 2023· Updated Jun 17, 2026
CVE-2023-28158
CVE-2023-28158
Description
Privilege escalation via stored XSS using the file upload service to upload malicious content. The issue can be exploited only by authenticated users which can create directory name to inject some XSS content and gain some privileges such admin user.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.archiva:archivaMaven | >= 2.0.0, < 2.2.10 | 2.2.10 |
Affected products
3Patches
Vulnerability mechanics
References
8- github.com/advisories/GHSA-qf34-f43r-gv9pghsaADVISORY
- lists.apache.org/thread/8pm6d5y9cptznm0bdny3n8voovmm0dttnvdMailing ListVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2023-28158ghsaADVISORY
- www.openwall.com/lists/oss-security/2023/04/18/2nvdWEB
- github.com/apache/archiva/commit/d62e81c7e75f617cf01d2a75952a2c857758f8c4ghsaWEB
- github.com/apache/archiva/commit/e7f7e70992d361d8b7a3298ddcdf49dda2fdc842ghsaWEB
- github.com/apache/archiva/commit/ee3ee0a18977b67b6997ea8cd023816201059f96ghsaWEB
- github.com/apache/archiva/releases/tag/archiva-2.2.10ghsaWEB
News mentions
0No linked articles in our index yet.