CVE-2022-40308 Apache Archiva prior to 2.2.9 may allow the anonymous user to read arbitrary files
An attacker can read arbitrary files, including the database, if anonymous read access is enabled in Apache Archiva.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-40308?
CVE-2022-40308 is a high-severity path traversal vulnerability in Apache Archiva, published on 15 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
If anonymous read enabled, it's possible to read the database file directly without logging in.
Which versions are affected by CVE-2022-40308?
2 open source packages ship an affected version, including org.apache.archiva:archiva-common. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.archiva:archiva-common Maven | All versions | 2.2.9 |
org.apache.archiva:archiva-common Maven | All versions | 2.2.9 |
Products include Apache Archiva.
How do I fix CVE-2022-40308?
Upgrade org.apache.archiva:archiva-common to 2.2.9 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-40308 being exploited?
There is no known exploitation of CVE-2022-40308 in the wild and no public exploit code.
Other vulnerabilities in Apache Archiva
- CVE-2013-2251 Apache Struts Improper Input Validation
- CVE-2016-4469 Cross-site request forgery in n/a
- CVE-2017-5657 Apache Archiva vulnerable to Cross Site Request Forgery
- CVE-2024-27138 Apache Archiva: disabling user registration is not effective
- CVE-2024-27139 Apache Archiva: incorrect authentication potentially leading to account takeover
Sources
Also known as GHSA-463w-hxfv-g9f6.