GHSA-7382-fv7p-v9v3Medium

Apache Continuum and Archiva vulnerable to Cross-site Scripting

Published
May 14, 2022
Last Modified
April 12, 2025

🔗 CVE IDs covered (1)

CVE-2011-0533 →

📋 Description

Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta; and Archiva 1.3.0 through 1.3.3 and 1.0 through 1.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to the autoIncludeParameters setting for the extremecomponents table.

🎯 Affected products3

  • maven/org.apache.archiva:archiva:>= 1.0, < 1.3.4
  • maven/org.apache.continuum:continuum:>= 1.1, < 1.3.7
  • maven/org.apache.continuum:continuum:= 1.4.0-beta

🔗 References (16)