CVE-2019-0214: Improper Input Validation in Apache Archiva
Summary
CVE-2019-0214: Improper Input Validation in Apache Archiva. Affects org.apache.archiva:archiva versions >= 2.2.0, < 2.2.4. Fixed in 2.2.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Archiva is a Maven repository manager that allows users to store and distribute their Java libraries. It provides a web interface for managing artifacts and supports various features such as artifact upload, search, and access control. However, versions 2.0.0 to 2.2.3 of Apache Archiva are vulnerable to an improper input validation issue.
Vulnerability Detail
The vulnerability in Apache Archiva allows an attacker to write files to arbitrary locations on the server by exploiting the artifact upload mechanism. This can lead to the overwrite of existing files if the Archiva run user has sufficient filesystem permissions for the target file. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level. The CWE ID associated with this vulnerability is CWE-20.
How To Fix
Minimum fixed version
2.2.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the official fix by upgrading to Apache Archiva 2.2.4 or a later version.
Conclusion
In conclusion, Apache Archiva versions 2.0.0 to 2.2.3 are vulnerable to an improper input validation issue that allows attackers to write files to arbitrary locations on the server. To mitigate this risk, users should upgrade to Apache Archiva 2.2.4 or a later version. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.archiva:archiva →
FAQ
Apache Archiva is a Maven repository manager that allows users to store and distribute their Java libraries. It provides a web interface for managing artifacts and supports various features such as artifact upload, search, and access control.
The vulnerability allows an attacker to write files to arbitrary locations on the server, potentially overwriting existing files. This can lead to unauthorized access, data loss, or disruption of services hosted by Apache Archiva.
To fix this vulnerability, it is recommended to upgrade to Apache Archiva version 2.2.4 or later. This version includes a fix for the improper input validation issue. Users should update their Archiva installations as soon as possible to mitigate the risk of file overwrites and unauthorized access.
There is no known workaround for this vulnerability. It is necessary to apply the official fix by upgrading to Apache Archiva 2.2.4 or a later version.
The severity level of this vulnerability is considered moderate, with a CVSS score of 6.5.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.archiva:archiva.
