CVE-2023-28158

Maven/org.apache.archiva:archiva CVE-2023-28158: medium 6.5

Apache Archiva vulnerable to privilege escalation via stored cross-site scripting (XSS)

Action: Upgrade org.apache.archiva:archiva to 2.2.10 or later.

Affected

Fixed versions

Sources

• osv: GHSA-qf34-f43r-gv9p
• https://nvd.nist.gov/vuln/detail/CVE-2023-28158
• https://github.com/apache/archiva/commit/d62e81c7e75f617cf01d2a75952a2c857758f8c4
• https://github.com/apache/archiva/commit/e7f7e70992d361d8b7a3298ddcdf49dda2fdc842
• https://github.com/apache/archiva/commit/ee3ee0a18977b67b6997ea8cd023816201059f96
• https://github.com/apache/archiva
• https://github.com/apache/archiva/releases/tag/archiva-2.2.10
• https://lists.apache.org/thread/8pm6d5y9cptznm0bdny3n8voovmm0dtt
• http://www.openwall.com/lists/oss-security/2023/04/18/2

CVE-2023-28158 · published 2023-03-29T15:30:17Z · modified 2023-11-08T04:12:09.535248Z · JSON