7.5
High
CVE-2022-40308 If anonymous read enabled, it's possible to read the database file directly without logging in
Description
If anonymous read enabled, it's possible to read the database file directly without logging in.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Archiva 2.2 | earliest → 2.2.8 | No fix stated |
References
- lists.apache.org lists.apache.org
- [oss-security] 20221115 CVE-2022-40308: Apache Archiva prior to 2.2.9 may allow the anonymous user to read arbitrary files www.openwall.com
Timeline
- Published
- Last modified
Other CVEs of Apache Archiva
The 8 CVEs of Apache Archiva →
CVE-2024-27138
** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva
Not rated
CVE-2024-27139
** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva: a vulnerability in Apache…
Not rated
CVE-2024-27140
** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')…
Not rated
CVE-2023-28158
Privilege escalation via stored XSS using the file upload service to upload malicious content
6.5
Medium