CVE-2024-27140

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-27140
** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Archiva. This issue affects Apache Archiva: from 2.0.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. Alternatively, you could configure a HTTP proxy in front of your Archiva instance to only forward requests that do not have malicious characters in the URL. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
http://www.openwall.com/lists/oss-security/2024/03/01/2 Mailing List
https://lists.apache.org/thread/xrn6nt904ozh3jym60c3f5hj2fb75pjy Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/03/01/2 Mailing List
https://lists.apache.org/thread/xrn6nt904ozh3jym60c3f5hj2fb75pjy Mailing List Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:archiva:*:*:*:*:*:*:*:*
History

28 May 2025, 19:54

Type Values Removed Values Added
CPE cpe:2.3:a:apache:archiva:*:*:*:*:*:*:*:*
References () http://www.openwall.com/lists/oss-security/2024/03/01/2 - () http://www.openwall.com/lists/oss-security/2024/03/01/2 - Mailing List
References () https://lists.apache.org/thread/xrn6nt904ozh3jym60c3f5hj2fb75pjy - () https://lists.apache.org/thread/xrn6nt904ozh3jym60c3f5hj2fb75pjy - Mailing List, Vendor Advisory
First Time Apache
Apache archiva

13 Feb 2025, 18:17

Type Values Removed Values Added
Summary (en) ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Archiva. This issue affects Apache Archiva: from 2.0.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. Alternatively, you could configure a HTTP proxy in front of your Archiva instance to only forward requests that do not have malicious characters in the URL. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. (en) ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Archiva. This issue affects Apache Archiva: from 2.0.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. Alternatively, you could configure a HTTP proxy in front of your Archiva instance to only forward requests that do not have malicious characters in the URL. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Information

Published : 2024-03-01 16:15

Updated : 2025-05-28 19:54

NVD link : CVE-2024-27140

Mitre link : CVE-2024-27140

CVE.ORG link : CVE-2024-27140

JSON object : View

Products Affected

apache

  • archiva
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')