CVE-2017-5657 json
Apache Archiva vulnerable to Cross Site Request Forgery
published 2017-05-22 9 y ago modified 2026-06-17 4 mo ago also GHSA-hf4p-mhc8-x2gp , EUVD-2022-4130
- cvss
- 8.0
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 59%
- public exploits
- 0
- none known
Summary
Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks. A malicious site opened in the same browser as the archiva site, may send an HTML response that performs arbitrary actions on archiva services, with the same rights as the active archiva session (e.g. administrator rights).
Patch / fix
Exploit prediction
0.87% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 8.0 | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.0 | AV:N/AC:M/Au:S/C:P/I:P/A:P |
| GitHub | 3.0 | 8.0 | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.archiva:archiva | <2.2.3 |
2.2.3 |
Affected products
- Apache Software Foundation Apache Archiva
Classification
- Weakness
-
- CWE-352 Cross-Site Request Forgery
References
-
archiva.apache.org
/security.html#CVE-2017-5657
web, patch, vendor-advisory
-
securityfocus.com
/bid/98570
vdb-entry, web, third-party-advisory
-
securitytracker.com
/id/1038528
vdb-entry
-
lists.apache.org
/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
mailing-list
-
nvd.nist.gov
/vuln/detail/CVE-2017-5657
advisory
-
github.com
/apache/archiva
package
-
lists.apache.org
/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E
web
-
web.archive.org
/web/20211206215453/https://securitytracker.com/id/1038528
web
Sources
- CVE List CVE-2017-5657
- GitHub Advisory GHSA-hf4p-mhc8-x2gp
- NVD CVE-2017-5657
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.