CVE-2023-28158
Apache Archiva privilege escalation
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 6.5EPSS 1.2%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado
Lifecycle
29 Mar 2023Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
Privilege escalation via stored XSS using the file upload service to upload malicious content.
The issue can be exploited only by authenticated users which can create directory name to inject some XSS content and gain some privileges such admin user.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Affected products
Apache Software Foundation · Apache Archiva