Home page logo
/

bugtraq logo Bugtraq mailing list archives

[SECURITY] CVE-2011-1026: Apache Archiva Multiple CSRF vulnerability
From: Deng Ching <oching () apache org>
Date: Fri, 27 May 2011 20:35:48 +0800

CVE-2011-1026: Apache Archiva Multiple CSRF vulnerability

Severity: High

Vendor:
The Apache Software Foundation

Versions Affected:
Archiva 1.3.0 - 1.3.4
The unsupported versions Archiva 1.0 - 1.2.2 are also affected.

Description:
An attacker can build a simple html page containing a hidden Image tag
(eg: <img src=vulnurl width=0 height=0 />) and entice the administrator
to access the page.
Mitigation:
Archiva 1.3.4 and earlier users should upgrade to 1.3.5

Credit:
This issue was discovered by Riyaz Ahemed Walikar of Microland Ltd., India

References:
http://archiva.apache.org/security.html

Thanks,
The Apache Archiva Team


  By Date           By Thread  

Current thread:
  • [SECURITY] CVE-2011-1026: Apache Archiva Multiple CSRF vulnerability Deng Ching (May 27)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]