CVE-2022-40308: Apache Archiva prior to 2.2.9 may allow the anonymous user to read arbitrary files
If anonymous read enabled, it's possible to read the database file directly without logging in.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
apache/archivato a version that resolves this vulnerability.Fixed in 2.2.9 - Configuration
Disable anonymous read so anonymous users cannot read arbitrary files or the database file without logging in.
Apache Archiva anonymous read enabled = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2022-40308?
CVE-2022-40308 is categorized as a high severity vulnerability due to the potential exposure of sensitive data.
How do I fix CVE-2022-40308?
To fix CVE-2022-40308, disable anonymous read access in the Apache Archiva configuration.
What impact does CVE-2022-40308 have on data security?
CVE-2022-40308 allows unauthorized users to access the database file directly, risking data confidentiality.
Which versions of Apache Archiva are affected by CVE-2022-40308?
CVE-2022-40308 affects all versions of Apache Archiva prior to 2.2.9.
Is there any workaround for CVE-2022-40308 until a fix is applied?
Yes, temporarily restrict access to the database by adjusting user permissions or disabling anonymous access.