CVE-2016-4469

High

Published: 28/07/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.3.9 and earlier allow remote attackers to hijack the authentication of administrators for various requests, such as adding new repositories or editing existing ones.

Risk Assessment

Attackers can exploit these vulnerabilities to make unauthorized changes to the system configuration, potentially leading to serious security breaches and loss of data integrity.

Recommendation

It is recommended to update Apache Archiva to the latest version to eliminate these vulnerabilities and implement additional CSRF protection mechanisms.

Other vulnerabilities in Apache Archiva

CVE-2017-5657High
Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks. A malicious site opened in the same browser as the archiva site may send an HTML response that performs arbitrary actions on archiva services with the same rights as the active archiva session.

Original NVD description (English source)

Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.3.9 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add new repository proxy connectors via the token parameter to admin/addProxyConnector_commit.action, (2) new repositories via the token parameter to admin/addRepository_commit.action, (3) edit existing repositories via the token parameter to admin/editRepository_commit.action, (4) add legacy artifact paths via the token parameter to admin/addLegacyArtifactPath_commit.action, (5) change the organizational appearance via the token parameter to admin/saveAppearance.action, or (6) upload new artifacts via the token parameter to upload_submit.action.