1. Home
  2. Vulnerabilities
  3. CVE-2017-5657

CVE-2017-5657

CVSS v3.0 8 (High)
80% Progress
CVSS v2.0 6 (Medium)
60% Progress
EPSS 0.10 % (41th)
0.10% Progress
Affected Products 1
Advisories 1
Info CVSS EPSS CAPEC Affected Configurations References Security Advisories Packages & Software Tools, Exploits & PoC Graph Web & Social Timeline

Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks. A malicious site opened in the same browser as the archiva site, may send an HTML response that performs arbitrary actions on archiva services, with the same rights as the active archiva session (e.g. administrator rights).

Weaknesses
CWE-352
Cross-Site Request Forgery (CSRF)
CVE Status
PUBLISHED
CNA
Apache Software Foundation
Published Date
2017-05-22 18:29:00
(7 years ago)
Updated Date
2023-11-07 02:49:30
(10 months ago)

Affected Products

Apache

Configuration #1

    CPE23 From Up To
  Apache Archiva 2.2.1 and prior versions cpe:2.3:a:apache:archiva <= 2.2.1