CVE-2017-5657

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks. A malicious site opened in the same browser as the archiva site, may send an HTML response that performs arbitrary actions on archiva services, with the same rights as the active archiva session (e.g. administrator rights).

Metrics

CVSS 3.0 8.0/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Archiva	1.x; 2.0.0, 2.0.1; 2.1.0, 2.1.1; 2.2.0, 2.2.1, 2.2.2

References

http://archiva.apache.org/security.html#CVE-2017-5657Patch, Vendor Advisory
http://www.securityfocus.com/bid/98570Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038528
https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
http://archiva.apache.org/security.html#CVE-2017-5657Patch, Vendor Advisory
http://www.securityfocus.com/bid/98570Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038528
https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E

Timeline

Published: May 22, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-56585.3The statistics generator in Apache Pony Mail 0.7 to 0.9 was found to be returning timestamp data without proper authorization checks. This c CVE-2017-56597.5Apache Traffic Server before 6.2.1 generates a coredump when there is a mismatch between content length and chunked encoding.CVE-2017-56608.6There is a vulnerability in Apache Traffic Server (ATS) 6.2.0 and prior and 7.0.0 and prior with the Host header and line folding. This can CVE-2017-56617.3In Apache FOP before 2.2, files lying on the filesystem of the server which uses FOP can be revealed to arbitrary users who send maliciously CVE-2017-56627.3In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send malicio CVE-2017-56638.8In Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating, an authenticated user with client/loan/center/staff/group read CVE-2017-56647.5The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error CVE-2017-56655.5The splt_cue_export_to_file function in cue.c in libmp3splt 0.9.2 allows remote attackers to cause a denial of service (NULL pointer derefer CVE-2017-56665.5The free_options function in options_manager.c in mp3splt 2.6.2 allows remote attackers to cause a denial of service (invalid free and crash CVE-2017-56676.5The sdhci_sdma_transfer_multi_blocks function in hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause CVE-2017-56689.8bitlbee-libpurple before 3.5.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) and possibly execut CVE-2017-56697.8The do_shmat function in ipc/shm.c in the Linux kernel through 4.9.12 does not restrict the address calculated by a certain rounding operati