CVE-2016-4469 json
Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.3.9 and earlier allow remote attackers to hijack the authent…
published 2016-07-28 10 y ago modified 2026-06-17 4 mo ago also EUVD-2016-5456
- cvss
- 8.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 7.9%
- EPSS 7.9% chance of exploitation in 30 days, percentile 94%
- public exploits
- 1
- Exploit-DB
Summary
Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.3.9 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add new repository proxy connectors via the token parameter to admin/addProxyConnector_commit.action, (2) new repositories via the token parameter to admin/addRepository_commit.action, (3) edit existing repositories via the token parameter to admin/editRepository_commit.action, (4) add legacy artifact paths via the token parameter to admin/addLegacyArtifactPath_commit.action, (5) change the organizational appearance via the token parameter to admin/saveAppearance.action, or (6) upload new artifacts via the token parameter to upload_submit.action.
Timeline
- First public exploit (EDB-40109)
- Published
Exploit prediction
7.86% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- EDB-40109 Apache Archiva 1.3.9 - Multiple Cross-Site Request Forgery Vulnerabilities webapps, 2016-07-13
- packetstormsecurity.com http://packetstormsecurity.com/files/137869/Apache-Archiva-1.3.9-Cross-Site-Request-Forgery.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-352 Cross-Site Request Forgery
References
-
exploit-db.com
/exploits/40109/
exploit
-
packetstormsecurity.com
/files/137869/Apache-Archiva-1.3.9-Cross-Site-Request-Forgery.html
exploit, third-party-advisory
-
seclists.org
/fulldisclosure/2016/Jul/37
mailing-list
-
securitytracker.com
/id/1036475
vdb-entry
-
securityfocus.com
/archive/1/538877/100/0/threaded
mailing-list
-
securityfocus.com
/bid/91703
vdb-entry
-
lists.apache.org
/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
mailing-list
Sources
- CVE List CVE-2016-4469
- NVD CVE-2016-4469
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.