CVE-2024-27140

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-27140
** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Archiva. This issue affects Apache Archiva: from 2.0.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. Alternatively, you could configure a HTTP proxy in front of your Archiva instance to only forward requests that do not have malicious characters in the URL. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS

No CVSS.

References
Link Resource
http://www.openwall.com/lists/oss-security/2024/03/01/2 Mailing List
http://www.openwall.com/lists/oss-security/2024/03/01/2 Mailing List
https://lists.apache.org/thread/xrn6nt904ozh3jym60c3f5hj2fb75pjy Mailing List Vendor Advisory
https://lists.apache.org/thread/xrn6nt904ozh3jym60c3f5hj2fb75pjy Mailing List Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:archiva:*:*:*:*:*:*:*:*
History

28 May 2025, 19:54

Type Values Removed Values Added
References () https://lists.apache.org/thread/xrn6nt904ozh3jym60c3f5hj2fb75pjy - () https://lists.apache.org/thread/xrn6nt904ozh3jym60c3f5hj2fb75pjy - Mailing List, Vendor Advisory
References () http://www.openwall.com/lists/oss-security/2024/03/01/2 - () http://www.openwall.com/lists/oss-security/2024/03/01/2 - Mailing List
CPE cpe:2.3:a:apache:archiva:*:*:*:*:*:*:*:*
First Time Apache archiva
Apache

13 Feb 2025, 18:17

Type Values Removed Values Added
Summary ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Archiva. This issue affects Apache Archiva: from 2.0.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. Alternatively, you could configure a HTTP proxy in front of your Archiva instance to only forward requests that do not have malicious characters in the URL. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Archiva. This issue affects Apache Archiva: from 2.0.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. Alternatively, you could configure a HTTP proxy in front of your Archiva instance to only forward requests that do not have malicious characters in the URL. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

04 Dec 2024, 21:15

Type Values Removed Values Added
CWE CWE-79

01 May 2024, 18:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/03/01/2 -

01 Mar 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-01 16:15

Updated : 2025-05-28 19:54

NVD link : CVE-2024-27140

Mitre link : CVE-2024-27140

JSON object : View

Products Affected

apache

  • archiva
CWE

No CWE.