CVE-2022-40309

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Users with write permissions to a repository can delete arbitrary directories.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Archiva	>= unspecified, <= 2.2.8

References

http://www.openwall.com/lists/oss-security/2022/11/15/3Mailing List, Third Party Advisory
https://lists.apache.org/thread/1odl4p85r96n27k577jk6ftrp19xfc27Issue Tracking, Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2022/11/15/3Mailing List, Third Party Advisory
https://lists.apache.org/thread/1odl4p85r96n27k577jk6ftrp19xfc27Issue Tracking, Mailing List, Vendor Advisory

Timeline

Published: Nov 15, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-40314.9The Simple:Press plugin for WordPress is vulnerable to arbitrary file modifications in versions up to, and including, 6.8 via the 'file' par CVE-2022-403103.1Authenticated (subscriber+) Race Condition vulnerability in Rate my Post – WP Rating System plugin <= 3.3.4 at WordPress allows attackers to CVE-2022-403114.8Auth. (admin+) Stored Cross-Site Scripting (XSS) in Fatcat Apps Analytics Cat plugin <= 1.0.9 on WordPress.CVE-2022-403126.5Server-Side Request Forgery (SSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Don CVE-2022-403137.1Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a page failing to load CVE-2022-403149.8A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified.CVE-2022-403159.8A limited SQL injection risk was identified in the "browse list of users" site administration page.CVE-2022-403164.3The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers ab CVE-2022-403175.4OpenKM 6.3.11 allows stored XSS related to the javascript&colon; substring in an A element.CVE-2022-403186.5An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an option of type 0xff (Extended Length CVE-2022-403197.5The LISTSERV 17 web interface allows remote attackers to conduct Insecure Direct Object References (IDOR) attacks via a modified email addre CVE-2022-40326.1The Quiz and Survey Master plugin for WordPress is vulnerable to iFrame Injection via the 'question[id]' parameter in versions up to, and in