CVE-2010-3449: apache archiva Cross-Site Request Forgery (CSRF)
Vulnerability summary
CVE-2010-3449 is a medium (CVSS 6.8) Cross-Site Request Forgery (CSRF) vulnerability in apache archiva. EPSS estimates a 4.84% chance of exploitation in the next 30 days, higher than 91.8% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 06-12-2010PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Cross-site request forgery (CSRF) vulnerability in Redback before 1.2.4, as used in Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1; and Apache Continuum 1.3.6, 1.4.0, and 1.1 through 1.2.3.1; allows remote attackers to hijack the authentication of administrators for requests that modify credentials.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
4.84%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
0.00 pp
From 4.84% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundApache Archiva 1.0 < 1.3.1 - Cross-Site Request Forgery
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Apache1 product
- archiva1.0 | 1.0.1 | 1.0.2 | 1.0.3 | 1.1 | 1.1.1 | 1.1.2 | 1.1.3 | 1.1.4 | 1.2 | 1.2.1 | 1.2.2 | 1.3 | 1.3.1
Jesse_mcconnell1 product
- redback≤ 1.2.3 | 1.0 | 1.0:alpha4 | 1.0.1 | 1.0.2 | 1.0.3 | 1.1 | 1.1.1 | 1.1.2 | 1.2 | 1.2:beta1 | 1.2:beta2 | 1.2.1 | 1.2.2
2 vendors · 2 products
References
19 links- jira.codehaus.org/browse/MRM-1438X Refsource CONFIRM
- svn.apache.org/viewvc?view=revision&revision=1066010X Refsource CONFIRM
- archiva.apache.org/security.htmlX Refsource CONFIRM
Show all 19 references
- svn.apache.org/viewvc?view=revision&revision=1038518X Refsource CONFIRM
- continuum.apache.org/security.htmlX Refsource CONFIRM