Mailing-List: contact dev-help@archiva.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@archiva.apache.org
Received-SPF: pass (athena.apache.org: domain of odeaching@gmail.com
 designates 209.85.161.42 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:sender:date:x-google-sender-auth:message-id:subject
         :from:to:content-type;
        b=KASlPWP5rBdxVoafN9qoNNRr+j9EwzfZK9XfYTxwz8zbYYLCUS3zhL8oTX6QA6A/Wp
         n1kW7Cv8OvjlziWpQ3tzU2UDc5OKI7aeNcmJAZQkQdWODnCrX5oJj8lVLvELbwFwYdfo
         rkLJGE0ohYVssMvfviyHRvRIvi5i0GOTDA3f0=
MIME-Version: 1.0
Sender: odeaching@gmail.com
Date: Fri, 27 May 2011 20:24:11 +0800
Message-ID: <BANLkTi=pm+vTHqKwp9fBt8fLnYqkmP_D4w@mail.gmail.com>
Subject: [SECURITY] CVE-2011-1077: Apache Archiva Multiple XSS vulnerability
From: Deng Ching <oching@apache.org>
To: announce@apache.org, bugtraq@securityfocus.com, security@apache.org,
	full-disclosure@lists.grok.org.uk, users@archiva.apache.org,
	dev@archiva.apache.org
Content-Type: multipart/alternative; boundary=0023545bd3ecdaa88604a4410321

--0023545bd3ecdaa88604a4410321
Content-Type: text/plain; charset=ISO-8859-1

CVE-2011-1077: Apache Archiva Multiple XSS vulnerability

Severity: High

Vendor:
The Apache Software Foundation

Versions Affected:
Archiva 1.3.0 - 1.3.4
The unsupported versions Archiva 1.0 - 1.2.2 are also affected.

Description:
The multiple XSS issues found are both Stored (Persistent) and
Reflected (Non-Persistent). Javascript which might contain malicious
code can be appended in a request parameter or stored as a value in a
submitted form, and get executed.

Mitigation:
Archiva 1.3.4 and earlier users should upgrade to 1.3.5

Credit:
This issue was discovered by Riyaz Ahemed Walikar of Microland Ltd., India

References:
http://archiva.apache.org/security.html

Thanks,
The Apache Archiva Team

--0023545bd3ecdaa88604a4410321--