CVE-2017-5657
Apache Archiva vulnerable to Cross Site Request Forgery
8.0
HIGH
CVSS 3.1
EPSS 0.14%
Description
Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks. A malicious site opened in the same browser as the archiva site, may send an HTML response that performs arbitrary actions on archiva services, with the same rights as the active archiva session (e.g. administrator rights).
How to fix CVE-2017-5657
To remediate CVE-2017-5657, upgrade the affected package to a fixed version below.
- —upgrade to 2.2.3 or later
Is CVE-2017-5657 being exploited?
Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 2.2.3
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.0 | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |