{"action":"Upgrade org.apache.archiva:archiva to 2.2.10 or later.","affected":[{"fixed":"2.2.10","introduced":"2.0.0"}],"component":"org.apache.archiva:archiva","cve_ids":["CVE-2023-28158"],"ecosystem":"Maven","epss":0.01162,"exploited":false,"fixed_versions":["2.2.10"],"ghsa_id":"GHSA-qf34-f43r-gv9p","id":"tcs_01M5N99C896RKQA5BVFFQG8B5Q","modified_at":"2023-11-08T04:12:09.535248Z","published_at":"2023-03-29T15:30:17Z","references":["https://osv.dev/vulnerability/GHSA-qf34-f43r-gv9p","https://nvd.nist.gov/vuln/detail/CVE-2023-28158","https://github.com/apache/archiva/commit/d62e81c7e75f617cf01d2a75952a2c857758f8c4","https://github.com/apache/archiva/commit/e7f7e70992d361d8b7a3298ddcdf49dda2fdc842","https://github.com/apache/archiva/commit/ee3ee0a18977b67b6997ea8cd023816201059f96","https://github.com/apache/archiva","https://github.com/apache/archiva/releases/tag/archiva-2.2.10","https://lists.apache.org/thread/8pm6d5y9cptznm0bdny3n8voovmm0dtt","http://www.openwall.com/lists/oss-security/2023/04/18/2"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-qf34-f43r-gv9p","url":"https://osv.dev/vulnerability/GHSA-qf34-f43r-gv9p"}],"summary":"Apache Archiva vulnerable to privilege escalation via stored cross-site scripting (XSS)"}