Apache Archiva Multiple Cross Site Request Forgery Vulnerabilities

Bugtraq ID:	48015
Class:	Design Error
CVE:	CVE-2011-1026
Remote:	Yes
Local:	No
Published:	May 27 2011 12:00AM
Updated:	May 31 2011 02:40PM
Credit:	Riyaz Ahemed Walikar
Vulnerable:	Apache Archiva 1.3.4 Apache Archiva 1.3.3 Apache Archiva 1.3.2 Apache Archiva 1.3.1 Apache Archiva 1.2.2 Apache Archiva 1.1.4 Apache Archiva 1.0.3 Apache Archiva 1.3 Apache Archiva 1.2 Apache Archiva 1.1 Apache Archiva 1.0
Not Vulnerable:	Apache Archiva 1.3.5

Apache Archiva Multiple Cross Site Request Forgery Vulnerabilities

Apache Archiva is prone to multiple cross-site request-forgery vulnerabilities.

Exploiting these issues may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application. Other attacks are also possible.

Apache Archiva versions 1.3.0 to 1.3.4 are vulnerable.

Apache Archiva Multiple Cross Site Request Forgery Vulnerabilities

To exploit these issues, an attacker must entice an unsuspecting victim to open a malicious URI.

Apache Archiva Multiple Cross Site Request Forgery Vulnerabilities

Solution:
Updates are available. Please see the reference for more details.

Apache Archiva Multiple Cross Site Request Forgery Vulnerabilities

References:

• [SECURITY] CVE-2011-1026: Apache Archiva Multiple CSRF vulnerability] (Deng Ching )
  
• Archiva Homepage (Apache)
  
• [CVE-2011-1026] Apache Archiva Multiple CSRF vulnerabilities (Walikar Riyaz Ahemed Dawalmalik)