Apache Archiva
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Apache Archiva.
By the Year
In 2026 there have been 0 vulnerabilities in Apache Archiva. Archiva did not have any published security vulnerabilities last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 0 | 0.00 |
| 2025 | 0 | 0.00 |
| 2024 | 3 | 0.00 |
| 2023 | 1 | 5.40 |
| 2022 | 3 | 6.10 |
| 2021 | 0 | 0.00 |
| 2020 | 1 | 0.00 |
| 2019 | 2 | 6.50 |
It may take a day or so for new Archiva vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Apache Archiva Security Vulnerabilities
Apache Archiva XSS in Web UI v2.0.0+
CVE-2024-27140
- March 01, 2024
** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Archiva. This issue affects Apache Archiva: from 2.0.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. Alternatively, you could configure a HTTP proxy in front of your Archiva instance to only forward requests that do not have malicious characters in the URL. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
XSS
Apache Archiva 2.x Unauthorized Account Modification (CVE-2024-27139)
CVE-2024-27139
- March 01, 2024
** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva: a vulnerability in Apache Archiva allows an unauthenticated attacker to modify account data, potentially leading to account takeover. This issue affects Apache Archiva: from 2.0.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
AuthZ
Incorrect Auth Bypass in Apache Archiva Deployments
CVE-2024-27138
- March 01, 2024
** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva. Apache Archiva has a setting to disable user registration, however this restriction can be bypassed. As Apache Archiva has been retired, we do not expect to release a version of Apache Archiva that fixes this issue. You are recommended to look into migrating to a different solution, or isolate your instance from any untrusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
AuthZ
Stored XSS Privilege Escalation via File Upload Service
CVE-2023-28158
5.4 - Medium
- March 29, 2023
Privilege escalation via stored XSS using the file upload service to upload malicious content. The issue can be exploited only by authenticated users which can create directory name to inject some XSS content and gain some privileges such admin user.
XSS
GitLab Repo Delete Arbitrary Directories with Write Access
CVE-2022-40309
4.3 - Medium
- November 15, 2022
Users with write permissions to a repository can delete arbitrary directories.
Anonymous Read Allows DB File Disclosure (CVE-2022-40308)
CVE-2022-40308
7.5 - High
- November 15, 2022
If anonymous read enabled, it's possible to read the database file directly without logging in.
In Apache Archiva, any registered user can reset password for any users
CVE-2022-29405
6.5 - Medium
- May 25, 2022
In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8
Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection
CVE-2020-9495
- June 19, 2020
Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute data from the connected LDAP server by providing special values to the login form. With certain characters it is possible to modify the LDAP filter used to query the LDAP users. By measuring the response time for the login request, arbitrary attribute data can be retrieved from LDAP user objects.
In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e
CVE-2019-0213
6.5 - Medium
- April 30, 2019
In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e. the logo URL. The vulnerability is considered as minor risk, as only users with admin role can change the configuration, or the communication between the browser and the Archiva server must be compromised.
XSS
In Apache Archiva 2.0.0 - 2.2.3
CVE-2019-0214
6.5 - Medium
- April 30, 2019
In Apache Archiva 2.0.0 - 2.2.3, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mechanism. Existing files can be overwritten, if the archiva run user has appropriate permission on the filesystem for the target file.
Improper Input Validation
Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks
CVE-2017-5657
- May 22, 2017
Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks. A malicious site opened in the same browser as the archiva site, may send an HTML response that performs arbitrary actions on archiva services, with the same rights as the active archiva session (e.g. administrator rights).
Apache Struts 2.0.0 through 2.3.15
CVE-2013-2251
9.8 - Critical
- July 20, 2013
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.
Injection
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Apache Archiva or by Apache? Click the Watch button to subscribe.
