Django REST framework

Lookup for vulnerable packages by Package URL.

Purl pkg:maven/org.apache.archiva/archiva@1.0

Type maven

Namespace org.apache.archiva

Name archiva

Version 1.0

Qualifiers

Subpath

Is_vulnerable true

Next_non_vulnerable_version 1.3.2

Latest_non_vulnerable_version 2.2.4

Affected_by_vulnerabilities

url VCID-7aky-87dx-nfab

vulnerability_id VCID-7aky-87dx-nfab

summary

Apache Continuum and Archiva vulnerable to Cross-site Scripting
Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta; and Archiva 1.3.0 through 1.3.3 and 1.0 through 1.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to the autoIncludeParameters setting for the extremecomponents table.

references

reference_url	https://exchange.xforce.ibmcloud.com/vulnerabilities/65343
reference_id
reference_type
scores
url	https://exchange.xforce.ibmcloud.com/vulnerabilities/65343

reference_url	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12581
reference_id
reference_type
scores
url	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12581

reference_url	https://web.archive.org/web/20110308092332/http://securitytracker.com/id?1025065
reference_id
reference_type
scores
url	https://web.archive.org/web/20110308092332/http://securitytracker.com/id?1025065

reference_url	https://web.archive.org/web/20111008021907/http://securityreason.com/securityalert/8091
reference_id
reference_type
scores
url	https://web.archive.org/web/20111008021907/http://securityreason.com/securityalert/8091

reference_url	https://web.archive.org/web/20200229160845/http://www.securityfocus.com/bid/46311
reference_id
reference_type
scores
url	https://web.archive.org/web/20200229160845/http://www.securityfocus.com/bid/46311

reference_url	https://web.archive.org/web/20201207190531/http://www.securityfocus.com/archive/1/516342/100/0/threaded
reference_id
reference_type
scores
url	https://web.archive.org/web/20201207190531/http://www.securityfocus.com/archive/1/516342/100/0/threaded

reference_url	https://web.archive.org/web/20201207190533/http://www.securityfocus.com/archive/1/516474/100/0/threaded
reference_id
reference_type
scores
url	https://web.archive.org/web/20201207190533/http://www.securityfocus.com/archive/1/516474/100/0/threaded

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2011-0533
reference_id	CVE-2011-0533
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2011-0533

reference_url	https://github.com/advisories/GHSA-7382-fv7p-v9v3
reference_id	GHSA-7382-fv7p-v9v3
reference_type
scores
url	https://github.com/advisories/GHSA-7382-fv7p-v9v3

fixed_packages

url	pkg:maven/org.apache.archiva/archiva@1.3.4
purl	pkg:maven/org.apache.archiva/archiva@1.3.4
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.archiva/archiva@1.3.4

aliases CVE-2011-0533, GHSA-7382-fv7p-v9v3

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-7aky-87dx-nfab

url VCID-wz1h-4zzv-8yde

vulnerability_id VCID-wz1h-4zzv-8yde

summary

Apache Archiva does not require entry of the administrator's password at the time of modifying a user account
Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1 does not require entry of the administrator's password at the time of modifying a user account, which makes it easier for context-dependent attackers to gain privileges by leveraging a (1) unattended workstation or (2) cross-site request forgery (CSRF) vulnerability, a related issue to CVE-2010-3449.

references

reference_url	https://github.com/apache/archiva
reference_id
reference_type
scores
url	https://github.com/apache/archiva

reference_url	https://web.archive.org/web/20201209001124/http://www.securityfocus.com/archive/1/514937/100/0/threaded
reference_id
reference_type
scores
url	https://web.archive.org/web/20201209001124/http://www.securityfocus.com/archive/1/514937/100/0/threaded

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2010-4408
reference_id	CVE-2010-4408
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2010-4408

reference_url	https://github.com/advisories/GHSA-5p54-jj38-3hxj
reference_id	GHSA-5p54-jj38-3hxj
reference_type
scores
url	https://github.com/advisories/GHSA-5p54-jj38-3hxj

fixed_packages

url	pkg:maven/org.apache.archiva/archiva@1.3.2
purl	pkg:maven/org.apache.archiva/archiva@1.3.2
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.archiva/archiva@1.3.2

aliases CVE-2010-4408, GHSA-5p54-jj38-3hxj

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-wz1h-4zzv-8yde

Fixing_vulnerabilities

Risk_score null

Resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.archiva/archiva@1.0

Package Instance