CVE-2019-0214

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

In Apache Archiva 2.0.0 - 2.2.3, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mechanism. Existing files can be overwritten, if the archiva run user has appropriate permission on the filesystem for the target file.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected software

VendorProductVersions
ApacheApache ArchivaAll versions prior to version 2.2.4

References

Timeline

Published
Apr 30, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-02157.5In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 CVE-2019-02164.8A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page viewCVE-2019-02177.5In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a userCVE-2019-02186.1A vulnerability was discovered wherein a specially crafted URL could enable reflected XSS via JavaScript in the pony mail interface.CVE-2019-02199.8A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a speciaCVE-2019-02205.3A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slasCVE-2019-02216.1The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escapiCVE-2019-02227.5In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.CVE-2019-02237.4While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and itCVE-2019-02246.1In Apache JSPWiki 2.9.0 to 2.11.0.M2, a carefully crafted URL could execute javascript on another user's session. No information could be saCVE-2019-02257.5A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.0 to 2.11.0.M2, whicCVE-2019-02264.9Apache Karaf Config service provides a install method (via service or MBean) that could be used to travel in any directory and overwrite exi
CVE-2019-0214: Medium severity, CVSS 6.5 | Vulnix