Is org.apache.archiva:archiva safe ? org.apache.archiva:archiva (maven) has 11 known vulnerabilities, the worst rated HIGH. No single fixed version is recorded that clears every advisory, so check each one below. No malicious-package signal is recorded.
// reach 0 direct dependencies
none carry a known advisory
0 packages depend on it
dependents not yet indexed for this ecosystem
// ai model usage Tracked for PyPI packages. HuggingFace models declare Python dependencies, so maven packages are not covered.
cvss CVSS v3.1 base score out of 10
epss chance of exploitation in 30 days, 72nd percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-h595-vwhc-3xwx, the advisory selected below
// 11 advisories GHSA-h595-vwhc-3xwx UNSUPPORTED WHEN ASSIGNED HIGH GHSA-rv4h-m4wc-v99w UNSUPPORTED WHEN ASSIGNED Incorrect Authorization vulnerability in Apache Archiva. HIGH GHSA-hf4p-mhc8-x2gp Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks. HIGH GHSA-qf34-f43r-gv9p Apache Archiva is vulnerable to privilege escalation vua stored cross-site-scripting using the file upload service to upload malicious content. MODE GHSA-5hqc-x78w-3cmw In Apache Archiva, any registered user can reset password for any users. MODE GHSA-5p54-jj38-3hxj Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1 does not require entry of the administrator's password at the… MODE GHSA-7382-fv7p-v9v3 Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta; and Archiva 1.3.0 through 1.3.3 and 1.0 through 1.2.2… MODE GHSA-8jfm-rgmg-3wq2 Cross-site scripting (XSS) vulnerability in Apache Archiva prior to version 2.2.1 allows remote authenticated administrators to inject arbitrary web script or… MODE GHSA-v83p-xwm9-v4g8 Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. MODE GHSA-cqcf-4g4h-rghf In Apache Archiva before 2.2.4, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mechanism. MODE GHSA-jxgm-9f58-w4xp In Apache Archiva 2.0.0 - 2.2.3, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mechanism. MODE // cvss v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality None
Integrity High
Availability None // questions Is org.apache.archiva:archiva safe to install? CyberXYZ does not call a package safe in absolute terms. It records 11 known vulnerabilities for org.apache.archiva:archiva (maven), the worst rated HIGH, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does org.apache.archiva:archiva have known vulnerabilities? Yes. CyberXYZ records 11 known vulnerabilities for org.apache.archiva:archiva (maven), the worst rated HIGH. These include GHSA-h595-vwhc-3xwx, GHSA-rv4h-m4wc-v99w, GHSA-hf4p-mhc8-x2gp, GHSA-qf34-f43r-gv9p, GHSA-5hqc-x78w-3cmw.
How do I check org.apache.archiva:archiva before installing? Search org.apache.archiva:archiva in CyberXYZ Check at https://cyberxyz.io/check?q=org.apache.archiva%3Aarchiva . The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 11:38 UTC. The most recent advisory here was published 2024-03-01. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page