What is GHSA-463w-hxfv-g9f6?

GHSA-463w-hxfv-g9f6 is a security advisory published by GitHub Security Advisories with High severity. Apache Archiva vulnerable to Sensitive Information Disclosure via anonymous user

Which CVE IDs does GHSA-463w-hxfv-g9f6 cover?

GHSA-463w-hxfv-g9f6 covers the following CVE IDs: CVE-2022-40308. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-463w-hxfv-g9f6?

GHSA-463w-hxfv-g9f6 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-463w-hxfv-g9f6?

GHSA-463w-hxfv-g9f6 affects 1 product, including: maven/org.apache.archiva:archiva-common:\u003c 2.2.9.

GHSA-463w-hxfv-g9f6HighCVSS 7.5

Apache Archiva vulnerable to Sensitive Information Disclosure via anonymous user

Vendor

GitHub Security Advisories

Published

November 15, 2022

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2022-40308 →

📋 Description

Apache Archiva prior to 2.2.9 may allow the anonymous user to read arbitrary files. If anonymous read enabled, it's possible to read the database file directly without logging in.

🎯 Affected products1

maven/org.apache.archiva:archiva-common:< 2.2.9

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2022-40308
https://lists.apache.org/thread/x01pnn0jjsw512cscxsbxzrjmz64n4cc
http://www.openwall.com/lists/oss-security/2022/11/15/2
https://archiva.apache.org/security.html
https://github.com/advisories/GHSA-463w-hxfv-g9f6