CVE-2016-4469: apache archiva Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2016-4469 is a high (CVSS 8.8) Cross-Site Request Forgery (CSRF) vulnerability in apache archiva. EPSS estimates a 7.86% chance of exploitation in the next 30 days, higher than 94.6% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 28-07-2016
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.3.9 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add new repository proxy connectors via the token parameter to admin/addProxyConnector_commit.action, (2) new repositories via the token parameter to admin/addRepository_commit.action, (3) edit existing repositories via the token parameter to admin/editRepository_commit.action, (4) add legacy artifact paths via the token parameter to admin/addLegacyArtifactPath_commit.action, (5) change the organizational appearance via the token parameter to admin/saveAppearance.action, or (6) upload new artifacts via the token parameter to upload_submit.action.

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.