CVE-2022-29405 : In Apache Archiva, any registered user can reset password for any users. This is

In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8

Published 2022-05-25 08:15:12

Updated 2022-06-06 13:24:48

View at NVD, CVE.org

Products affected by CVE-2022-29405

Apache » Archiva
Versions before (<) 2.2.8
cpe:2.3:a:apache:archiva:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 21 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.0	MEDIUM	AV:N/AC:L/Au:S/C:N/I:P/A:N	8.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Assigned by: nvd@nist.gov (Primary)

https://archiva.apache.org/docs/2.2.8/release-notes.html

Archiva Documentation – Release Notes for Archiva 2.2.8
Release Notes;Vendor Advisory

Jump to