CVE-2010-4408 Apache Archiva does not require entry of the administrator's password at the time of modifying a user account
MediumCVSS 6.8
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1 does not require entry of the administrator's password at the time of modifying a user account, which makes it easier for context-dependent attackers to gain privileges by leveraging a (1) unattended workstation or (2) cross-site request forgery (CSRF) vulnerability, a related issue to CVE-2010-3449.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.archiva/archiva(Maven) | >= 1.0, < 1.3.2 | 1.3.2 |
| org.apache.archiva/archiva(Maven) | = 1.1 | No fix listed |
| org.apache.archiva/archiva(Maven) | = 1.1.1 | No fix listed |
| org.apache.archiva/archiva(Maven) | = 1.1.2 | No fix listed |
| org.apache.archiva/archiva(Maven) | = 1.1.3 | No fix listed |
| org.apache.archiva/archiva(Maven) | = 1.1.4 | No fix listed |
| org.apache.archiva/archiva(Maven) | = 1.2 | No fix listed |
| org.apache.archiva/archiva(Maven) | = 1.2-M1 | No fix listed |
| org.apache.archiva/archiva(Maven) | = 1.2.1 | No fix listed |
| org.apache.archiva/archiva(Maven) | = 1.2.2 | No fix listed |
| org.apache.archiva/archiva(Maven) | = 1.3 | No fix listed |
| org.apache.archiva/archiva(Maven) | = 1.3.1 | No fix listed |
| apache archiva | = 1.0 | No fix listed |
| apache archiva | = 1.0.1 | No fix listed |
| apache archiva | = 1.0.2 | No fix listed |
| apache archiva | = 1.0.3 | No fix listed |
| apache archiva | = 1.1 | No fix listed |
| apache archiva | = 1.1.1 | No fix listed |
| apache archiva | = 1.1.2 | No fix listed |
| apache archiva | = 1.1.3 | No fix listed |
| apache archiva | = 1.1.4 | No fix listed |
| apache archiva | = 1.2 | No fix listed |
| apache archiva | = 1.2.1 | No fix listed |
| apache archiva | = 1.2.2 | No fix listed |
| apache archiva | = 1.3 | No fix listed |
Show 1 more
| Product | Affected versions | Fixed in |
|---|---|---|
| apache archiva | = 1.3.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com product
- web.archive.org
- archiva.apache.org
- [archiva-users] 20101129 Apache Archiva CSRF Vulnerability mailing-list
- mail-archives.apache.org
- 20101129 [CVE-2010-3449] Apache Archiva CSRF Vulnerability mailing-list
- github.com