CVE-2011-0533 Apache Continuum and Archiva vulnerable to Cross-site Scripting
MediumCVSS 4.3
EPSS 4.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta; and Archiva 1.3.0 through 1.3.3 and 1.0 through 1.22 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to the autoIncludeParameters setting for the extremecomponents table.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.archiva/archiva(Maven) | >= 1.0, < 1.3.4 | 1.3.4 |
| org.apache.archiva/archiva(Maven) | = 1.1 | No fix listed |
| org.apache.archiva/archiva(Maven) | = 1.1.1 | No fix listed |
| org.apache.archiva/archiva(Maven) | = 1.1.2 | No fix listed |
| org.apache.archiva/archiva(Maven) | = 1.1.3 | No fix listed |
| org.apache.archiva/archiva(Maven) | = 1.1.4 | No fix listed |
| org.apache.archiva/archiva(Maven) | = 1.2 | No fix listed |
| org.apache.archiva/archiva(Maven) | = 1.2-M1 | No fix listed |
| org.apache.archiva/archiva(Maven) | = 1.2.1 | No fix listed |
| org.apache.archiva/archiva(Maven) | = 1.2.2 | No fix listed |
| org.apache.archiva/archiva(Maven) | = 1.3 | No fix listed |
| org.apache.archiva/archiva(Maven) | = 1.3.1 | No fix listed |
| org.apache.archiva/archiva(Maven) | = 1.3.2 | No fix listed |
| org.apache.archiva/archiva(Maven) | = 1.3.3 | No fix listed |
| org.apache.continuum/continuum(Maven) | >= 1.1, < 1.3.7 | 1.3.7 |
| org.apache.continuum/continuum(Maven) | = 1.2 | No fix listed |
| org.apache.continuum/continuum(Maven) | = 1.2.2 | No fix listed |
| org.apache.continuum/continuum(Maven) | = 1.2.3 | No fix listed |
| org.apache.continuum/continuum(Maven) | = 1.3.1 | No fix listed |
| org.apache.continuum/continuum(Maven) | = 1.3.2 | No fix listed |
| org.apache.continuum/continuum(Maven) | = 1.3.3 | No fix listed |
| org.apache.continuum/continuum(Maven) | = 1.3.4 | No fix listed |
| org.apache.continuum/continuum(Maven) | = 1.3.5 | No fix listed |
| org.apache.continuum/continuum(Maven) | = 1.3.6 | No fix listed |
| org.apache.continuum/continuum(Maven) | = 1.4.0-beta | No fix listed |
Show 23 more
| Product | Affected versions | Fixed in |
|---|---|---|
| apache continuum | = 1.1 | No fix listed |
| apache continuum | = 1.2 | No fix listed |
| apache continuum | = 1.2.2 | No fix listed |
| apache continuum | = 1.2.3 | No fix listed |
| apache continuum | = 1.2.3.1 | No fix listed |
| apache continuum | = 1.3.6 | No fix listed |
| apache continuum | = 1.4.0-beta | No fix listed |
| apache archiva | = 1.0 | No fix listed |
| apache archiva | = 1.0.1 | No fix listed |
| apache archiva | = 1.0.2 | No fix listed |
| apache archiva | = 1.0.3 | No fix listed |
| apache archiva | = 1.1 | No fix listed |
| apache archiva | = 1.1.1 | No fix listed |
| apache archiva | = 1.1.2 | No fix listed |
| apache archiva | = 1.1.3 | No fix listed |
| apache archiva | = 1.1.4 | No fix listed |
| apache archiva | = 1.2 | No fix listed |
| apache archiva | = 1.2.1 | No fix listed |
| apache archiva | = 1.2.2 | No fix listed |
| apache archiva | = 1.3 | No fix listed |
| apache archiva | = 1.3.1 | No fix listed |
| apache archiva | = 1.3.2 | No fix listed |
| apache archiva | = 1.3.3 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- continuum-unspec-xss(65343) vdb-entry
- oval:org.mitre.oval:def:12581 signature vdb-entry
- web.archive.org
- web.archive.org
- web.archive.org
- web.archive.org
- web.archive.org
- continuum.apache.org
- jira.codehaus.org
- [continuum-users] 20110210 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability mailing-list
- mail-archives.apache.org
- 20110211 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability mailing-list patch
- svn.apache.org patch
- svn.apache.org patch
- 70925 vdb-entry
- 43261 third-party-advisory vendor-advisory
- 43334 third-party-advisory vendor-advisory
- 8091 third-party-advisory
- 1025065 vdb-entry
- 20110210 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability mailing-list
- 20110216 [SECURITY] CVE-2011-0533: Apache Archiva cross-site scripting vulnerability mailing-list
- 46311 vdb-entry
- ADV-2011-0373 vdb-entry vendor-advisory
- ADV-2011-0426 vdb-entry vendor-advisory
- github.com