Skip to content
Fencer Intel
medium 4.3

CVE-2011-0533 json

Apache Continuum and Archiva vulnerable to Cross-site Scripting

published 2011-02-17 15 y ago modified 2026-06-16 4 mo ago also GHSA-7382-fv7p-v9v3 , EUVD-2011-0552

cvss
4.3
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
4.2%
EPSS 4.2% chance of exploitation in 30 days, percentile 91%
public exploits
0
none known

Summary

Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta; and Archiva 1.3.0 through 1.3.3 and 1.0 through 1.22 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to the autoIncludeParameters setting for the extremecomponents table.

Patch / fix

  • maven org.apache.archiva:archiva 1.3.4
  • maven org.apache.continuum:continuum 1.3.7

Exploit prediction

4.20% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected packages

ecosystem package affected fixed in
maven org.apache.archiva:archiva
>=1.0, <1.3.4
1.3.4
maven org.apache.continuum:continuum
>=1.1, <1.3.7
1 listed version
1.3.7

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.