CVE-2016-5005

4.8MEDIUM

Key Information:

Vendor
Apache
Status
Archiva
Vendor
CVE Published:
28 July 2016

Summary

Cross-site scripting (XSS) vulnerability in Apache Archiva 1.3.9 and earlier allows remote authenticated administrators to inject arbitrary web script or HTML via the connector.sourceRepoId parameter to admin/addProxyConnector_commit.action.

References

http://www.securityfocus.com/archive/1/538878/100/0/threaded
mailing-listx_refsource_BUGTRAQ
http://www.securitytracker.com/id/1036475
vdb-entryx_refsource_SECTRACK
http://packetstormsecurity.com/files/137870/Apache-Archiv...
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.