CVE-2022-29405: Apache Archiva Arbitrary user password reset vulnerability
Published May 25, 2022
·Updated
In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8
Affected Software
1 affected component
Apache Archiva<2.2.8
Event History
May 25, 2022
CVE Published
via MITRE·07:15 AM
Data Sourced
via MITRE·07:15 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2022-29405?
CVE-2022-29405 is classified as a high severity vulnerability due to its potential for unauthorized password resets.
2
How do I fix CVE-2022-29405?
To fix CVE-2022-29405, upgrade Apache Archiva to version 2.2.8 or later.
3
What impact does CVE-2022-29405 have on users?
CVE-2022-29405 allows any registered user to reset the passwords of other users, compromising account security.
4
Which versions of Apache Archiva are affected by CVE-2022-29405?
CVE-2022-29405 affects all versions of Apache Archiva prior to 2.2.8.
5
Is there a workaround for CVE-2022-29405?
There is no known workaround for CVE-2022-29405; upgrading is recommended for security.