CVE-2024-27138

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva.

Apache Archiva has a setting to disable user registration, however this restriction can be bypassed. As Apache Archiva has been retired, we do not expect to release a version of Apache Archiva that fixes this issue. You are recommended to look into migrating to a different solution, or isolate your instance from any untrusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Mar 1, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-271397.5** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva: a vulnerability in Apache Archiva allows an unauth CVE-2024-27146.5A vulnerability has been found in Campcodes Complete Online DJ Booking System 1.0 and classified as critical. Affected by this vulnerability CVE-2024-271405.4** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apach CVE-2024-271415.9Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is CVE-2024-271425.9Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is CVE-2024-271439.8Toshiba printers use SNMP for configuration. Using the private community, it is possible to remotely execute commands as root on the remote CVE-2024-271449.8The Toshiba printers provide several ways to upload files using the web interface without authentication. An attacker can overwrite any inse CVE-2024-271459.8The Toshiba printers provide several ways to upload files using the admin web interface. An attacker can remotely compromise any Toshiba pri CVE-2024-271466.7The Toshiba printers do not implement privileges separation. As for the affected products/models/versions, see the reference URL.CVE-2024-271477.4The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. CVE-2024-271487.4The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. CVE-2024-271497.4The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer.