GHSA-8jfm-rgmg-3wq2

Apache Archiva vulnerable to Cross-site Scripting

Source: GitHub Advisory Database (reviewed) Moderate CVE-2016-5005

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.archiva:archiva	< 2.2.1	2.2.1

Details

As written in the advisory (Markdown source, shown as plain text).

Cross-site scripting (XSS) vulnerability in Apache Archiva prior to version 2.2.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the connector.sourceRepoId parameter to admin/addProxyConnector_commit.action.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2016-5005 advisory
https://github.com/apache/archiva package
https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E web
https://web.archive.org/web/20211208111430/https://securitytracker.com/id/1036475 web
http://packetstormsecurity.com/files/137870/Apache-Archiva-1.3.9-Cross-Site-Scripting.html web
http://seclists.org/fulldisclosure/2016/Jul/38 web
http://www.securityfocus.com/archive/1/538878/100/0/threaded web
http://www.securityfocus.com/bid/91707 web