PT-2022-25340

CVE-2022-40308

Published

2022-11-15

Updated

2025-04-30

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Archiva versions prior to 2.2.9

Description The issue allows an anonymous user to read arbitrary files, including the database file, directly without logging in if anonymous read is enabled.

Recommendations For Apache Archiva versions prior to 2.2.9, update to version 2.2.9 or later to resolve the issue. As a temporary workaround, consider disabling anonymous read access to minimize the risk of exploitation.

Exploitability

Exploit

Fix

Impacts

Researchers

L3Yx

L3Yx Of

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor