ID de Prueba:	1.3.6.1.4.1.25623.1.0.808280
Categoría:	Web application abuses
Título:	Apache Archiva < 2.2.1 Multiple Vulnerabilities
Resumen:	Apache Archiva is prone to cross-site request forgery (CSRF) and; cross-site scripting (XSS) vulnerabilities.
Descripción:	Summary: Apache Archiva is prone to cross-site request forgery (CSRF) and cross-site scripting (XSS) vulnerabilities. Vulnerability Insight: Multiple flaws are due to: - An insufficient validation of user supplied input via HTTP POST parameter 'connector.sourceRepoId' to 'admin/addProxyConnector_commit.action'. - The application lacks a Cross-Site Request Forgery protection to certain HTTP POST-based functions Vulnerability Impact: Successful exploitation will allow remote attackers to perform sensitive administrative actions and to inject arbitrary web script or HTML. Affected Software/OS: Apache Archiva version 1.3.9 and prior. Solution: Update to version 2.2.1 or later. CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2016-4469 BugTraq ID: 91703 http://www.securityfocus.com/bid/91703 Bugtraq: 20160711 [RCESEC-2016-003][CVE-2016-4469] Apache Archiva 1.3.9 Multiple Cross-Site Request Forgeries (Google Search) http://www.securityfocus.com/archive/1/538877/100/0/threaded https://www.exploit-db.com/exploits/40109/ http://seclists.org/fulldisclosure/2016/Jul/37 http://packetstormsecurity.com/files/137869/Apache-Archiva-1.3.9-Cross-Site-Request-Forgery.html https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E http://www.securitytracker.com/id/1036475 Common Vulnerability Exposure (CVE) ID: CVE-2016-5005 BugTraq ID: 91707 http://www.securityfocus.com/bid/91707 Bugtraq: 20160711 [RCESEC-2016-004][CVE-2016-5005] Apache Archiva 1.3.9 admin/addProxyConnector_commit.action connector.sourceRepoId Persistent Cross-Site Scripting (Google Search) http://www.securityfocus.com/archive/1/538878/100/0/threaded http://seclists.org/fulldisclosure/2016/Jul/38 http://packetstormsecurity.com/files/137870/Apache-Archiva-1.3.9-Cross-Site-Scripting.html
Copyright	Copyright (C) 2016 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.