CVE-2024-27140

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

** UNSUPPORTED WHEN ASSIGNED **

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Archiva.

This issue affects Apache Archiva: from 2.0.0.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. Alternatively, you could configure a HTTP proxy in front of your Archiva instance to only forward requests that do not have malicious characters in the URL.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Archiva	>= 2.0.0, <= *

References

http://www.openwall.com/lists/oss-security/2024/03/01/2Mailing List
https://lists.apache.org/thread/xrn6nt904ozh3jym60c3f5hj2fb75pjyMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/03/01/2Mailing List
https://lists.apache.org/thread/xrn6nt904ozh3jym60c3f5hj2fb75pjyMailing List, Vendor Advisory

Timeline

Published: Mar 1, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-271415.9Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is CVE-2024-271425.9Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is CVE-2024-271439.8Toshiba printers use SNMP for configuration. Using the private community, it is possible to remotely execute commands as root on the remote CVE-2024-271449.8The Toshiba printers provide several ways to upload files using the web interface without authentication. An attacker can overwrite any inse CVE-2024-271459.8The Toshiba printers provide several ways to upload files using the admin web interface. An attacker can remotely compromise any Toshiba pri CVE-2024-271466.7The Toshiba printers do not implement privileges separation. As for the affected products/models/versions, see the reference URL.CVE-2024-271477.4The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. CVE-2024-271487.4The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. CVE-2024-271497.4The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. CVE-2024-27156.1A vulnerability was found in Campcodes Complete Online DJ Booking System 1.0 and classified as problematic. Affected by this issue is some u CVE-2024-271507.4The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. CVE-2024-271517.4The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer.