{"action":"Upgrade org.apache.archiva:archiva-common to 2.2.9 or later.","affected":[{"fixed":"2.2.9","introduced":"0"}],"component":"org.apache.archiva:archiva-common","cve_ids":["CVE-2022-40309"],"ecosystem":"Maven","epss":0.01496,"exploited":false,"fixed_versions":["2.2.9"],"ghsa_id":"GHSA-xgq8-jq9w-77r5","id":"tcs_01M5N9JB2F0D8TSCCG87BYA786","modified_at":"2023-11-08T04:10:23.345108Z","published_at":"2022-11-15T19:00:52Z","references":["https://osv.dev/vulnerability/GHSA-xgq8-jq9w-77r5","https://nvd.nist.gov/vuln/detail/CVE-2022-40309","https://github.com/apache/archiva","https://lists.apache.org/thread/1odl4p85r96n27k577jk6ftrp19xfc27","http://www.openwall.com/lists/oss-security/2022/11/15/3"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-xgq8-jq9w-77r5","url":"https://osv.dev/vulnerability/GHSA-xgq8-jq9w-77r5"}],"summary":"Apache Archiva subject to arbitrary directory deletion by users."}