Miggo Logo

CVE-2016-5005: Apache Archiva vulnerable to Cross-site Scripting

4.8

CVSS Score
3.0

Basic Information

EPSS Score
0.72017%
Published
5/14/2022
Updated
2/2/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.apache.archiva:archivamaven< 2.2.12.2.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from unsanitized processing of the 'connector.sourceRepoId' parameter in the '/admin/addProxyConnector_commit.action' endpoint. The action handler (likely in an AdminAction class) accepts this parameter and persists it without neutralization. The stored value is later reflected in administrative pages like 'Proxy Connectors' and 'Delete Proxy Connector' without output encoding, enabling XSS. While the exact code isn't available, Struts framework conventions and the advisory's endpoint/parameter specificity strongly indicate the action handler as the vulnerable function.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*ross-sit* s*riptin* (XSS) vuln*r**ility in *p**** *r**iv* prior to v*rsion *.*.* *llows r*mot* *ut**nti**t** **ministr*tors to inj**t *r*itr*ry w** s*ript or *TML vi* t** *onn**tor.sour**R*poI* p*r*m*t*r to **min/***Proxy*onn**tor_*ommit.**tion.

Reasoning

T** vuln*r**ility st*ms *rom uns*nitiz** pro**ssin* o* t** `'*onn**tor.sour**R*poI*'` p*r*m*t*r in t** `'/**min/***Proxy*onn**tor_*ommit.**tion'` *n*point. T** **tion **n*l*r (lik*ly in *n `**min**tion` *l*ss) ****pts t*is p*r*m*t*r *n* p*rsists it w