CVE-2019-0214

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-0214
In Apache Archiva 2.0.0 - 2.2.3, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mechanism. Existing files can be overwritten, if the archiva run user has appropriate permission on the filesystem for the target file.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector : AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.5 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:N/I:P/A:P

Exploitability : 8.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://archiva.apache.org/security.html#CVE-2019-0214 Vendor Advisory
http://packetstormsecurity.com/files/152684/Apache-Archiva-2.2.3-File-Write-Delete.html Mitigation Third Party Advisory VDB Entry
http://www.openwall.com/lists/oss-security/2019/04/30/8 Mailing List Third Party Advisory
http://www.securityfocus.com/bid/108124 Third Party Advisory VDB Entry
https://lists.apache.org/thread.html/18b670afc2f83034f47ebeb2f797c350fe60f1f2b33c95b95f467ef8%40%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/239349b6dd8f66cf87a70c287b03af451dea158b776d3dfc550b4f0e%40%3Cusers.maven.apache.org%3E
https://lists.apache.org/thread.html/5851cb0214f22ba681fb445870eeb6b01afd1fb614e45a22978d7dda%40%3Cusers.archiva.apache.org%3E
https://lists.apache.org/thread.html/ada0052409d8a4a8c4eb2c7fd6b9cd9423bc753d5fce87eb826662fb%40%3Cissues.archiva.apache.org%3E
https://seclists.org/bugtraq/2019/Apr/48 Mailing List Third Party Advisory
http://archiva.apache.org/security.html#CVE-2019-0214 Vendor Advisory
http://packetstormsecurity.com/files/152684/Apache-Archiva-2.2.3-File-Write-Delete.html Mitigation Third Party Advisory VDB Entry
http://www.openwall.com/lists/oss-security/2019/04/30/8 Mailing List Third Party Advisory
http://www.securityfocus.com/bid/108124 Third Party Advisory VDB Entry
https://lists.apache.org/thread.html/18b670afc2f83034f47ebeb2f797c350fe60f1f2b33c95b95f467ef8%40%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/239349b6dd8f66cf87a70c287b03af451dea158b776d3dfc550b4f0e%40%3Cusers.maven.apache.org%3E
https://lists.apache.org/thread.html/5851cb0214f22ba681fb445870eeb6b01afd1fb614e45a22978d7dda%40%3Cusers.archiva.apache.org%3E
https://lists.apache.org/thread.html/ada0052409d8a4a8c4eb2c7fd6b9cd9423bc753d5fce87eb826662fb%40%3Cissues.archiva.apache.org%3E
https://seclists.org/bugtraq/2019/Apr/48 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:apache:archiva:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:archiva:*:*:*:*:*:*:*:*
History

21 Nov 2024, 04:16

Type Values Removed Values Added
References () http://archiva.apache.org/security.html#CVE-2019-0214 - Vendor Advisory () http://archiva.apache.org/security.html#CVE-2019-0214 - Vendor Advisory
References () http://packetstormsecurity.com/files/152684/Apache-Archiva-2.2.3-File-Write-Delete.html - Mitigation, Third Party Advisory, VDB Entry () http://packetstormsecurity.com/files/152684/Apache-Archiva-2.2.3-File-Write-Delete.html - Mitigation, Third Party Advisory, VDB Entry
References () http://www.openwall.com/lists/oss-security/2019/04/30/8 - Mailing List, Third Party Advisory () http://www.openwall.com/lists/oss-security/2019/04/30/8 - Mailing List, Third Party Advisory
References () http://www.securityfocus.com/bid/108124 - Third Party Advisory, VDB Entry () http://www.securityfocus.com/bid/108124 - Third Party Advisory, VDB Entry
References () https://lists.apache.org/thread.html/18b670afc2f83034f47ebeb2f797c350fe60f1f2b33c95b95f467ef8%40%3Cannounce.apache.org%3E - () https://lists.apache.org/thread.html/18b670afc2f83034f47ebeb2f797c350fe60f1f2b33c95b95f467ef8%40%3Cannounce.apache.org%3E -
References () https://lists.apache.org/thread.html/239349b6dd8f66cf87a70c287b03af451dea158b776d3dfc550b4f0e%40%3Cusers.maven.apache.org%3E - () https://lists.apache.org/thread.html/239349b6dd8f66cf87a70c287b03af451dea158b776d3dfc550b4f0e%40%3Cusers.maven.apache.org%3E -
References () https://lists.apache.org/thread.html/5851cb0214f22ba681fb445870eeb6b01afd1fb614e45a22978d7dda%40%3Cusers.archiva.apache.org%3E - () https://lists.apache.org/thread.html/5851cb0214f22ba681fb445870eeb6b01afd1fb614e45a22978d7dda%40%3Cusers.archiva.apache.org%3E -
References () https://lists.apache.org/thread.html/ada0052409d8a4a8c4eb2c7fd6b9cd9423bc753d5fce87eb826662fb%40%3Cissues.archiva.apache.org%3E - () https://lists.apache.org/thread.html/ada0052409d8a4a8c4eb2c7fd6b9cd9423bc753d5fce87eb826662fb%40%3Cissues.archiva.apache.org%3E -
References () https://seclists.org/bugtraq/2019/Apr/48 - Mailing List, Third Party Advisory () https://seclists.org/bugtraq/2019/Apr/48 - Mailing List, Third Party Advisory
Information

Published : 2019-04-30 22:29

Updated : 2024-11-21 04:16

NVD link : CVE-2019-0214

Mitre link : CVE-2019-0214

CVE.ORG link : CVE-2019-0214

JSON object : View

Products Affected

apache

  • archiva
CWE
NVD-CWE-noinfo