CVE-2024-27140
Published: 01 March 2024
Summary
CVE-2024-27140 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Apache Archiva. Its CVSS base score is 5.4 (Medium).
Operationally, ranked in the top 8.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-27140 is a cross-site scripting vulnerability (CWE-79) affecting Apache Archiva versions 2.0.0 and later. The flaw stems from improper neutralization of input during web page generation and is labeled unsupported when assigned because the Apache Archiva project has been retired with no planned fixes.
An authenticated user with low privileges can supply malicious input via URLs or request parameters that is later rendered in other users' browsers, enabling reflected or stored XSS. Successful exploitation requires user interaction and yields limited impacts consisting of confidentiality and integrity loss within the application's scope, without affecting availability.
Apache advisories state that no corrective release will be issued and instead recommend replacing the instance, restricting access exclusively to trusted users, or placing an HTTP proxy in front of Archiva to drop requests containing suspicious characters in the URL. The associated EPSS scores have remained low, with a current value of 0.0623 and a peak of 0.0795.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-0941
Vulnerability details
** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Archiva. This issue affects Apache Archiva: from 2.0.0. As this project is retired, we do not plan to release a version that…
more
fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. Alternatively, you could configure a HTTP proxy in front of your Archiva instance to only forward requests that do not have malicious characters in the URL. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.