CVE-2010-4408

Опубликовано: 06 дек. 2010

Источник: nvd

CVSS2: 6.8

EPSS Низкий

Описание

Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1 does not require entry of the administrator's password at the time of modifying a user account, which makes it easier for context-dependent attackers to gain privileges by leveraging a (1) unattended workstation or (2) cross-site request forgery (CSRF) vulnerability, a related issue to CVE-2010-3449.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:archiva:1.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:archiva:1.0.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:archiva:1.0.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:archiva:1.0.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:archiva:1.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:archiva:1.1.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:archiva:1.1.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:archiva:1.1.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:archiva:1.1.4:*:*:*:*:*:*:*

cpe:2.3:a:apache:archiva:1.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:archiva:1.2.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:archiva:1.2.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:archiva:1.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:archiva:1.3.1:*:*:*:*:*:*:*

EPSS

Процентиль: 80%

0.01385

Низкий

6.8 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-5p54-jj38-3hxj

github

больше 3 лет назад

Apache Archiva does not require entry of the administrator's password at the time of modifying a user account