[SECURITY] CVE-2011-1077: Apache Archiva Multiple XSS vulnerability

From: Deng Ching <oching@apache.org>
To: bugtraq@securityfocus.com
Cc:
Subject: [SECURITY] CVE-2011-1077: Apache Archiva Multiple XSS vulnerability
Date:


CVE-2011-1077: Apache Archiva Multiple XSS vulnerability

Severity: High

Vendor:
The Apache Software Foundation

Versions Affected:
Archiva 1.3.0 - 1.3.4
The unsupported versions Archiva 1.0 - 1.2.2 are also affected.

Description:
The multiple XSS issues found are both Stored (Persistent) and
Reflected (Non-Persistent). Javascript which might contain malicious
code can be appended in a request parameter or stored as a value in a
submitted form, and get executed.

Mitigation:
Archiva 1.3.4 and earlier users should upgrade to 1.3.5

Credit:
This issue was discovered by Riyaz Ahemed Walikar of Microland Ltd., India

References:
http://archiva.apache.org/security.html

Thanks,
The Apache Archiva Team





Copyright © 1995-2018 LinuxRocket.net. All rights reserved.