CVE-2023-28158: Apache Archiva privilege escalation
Privilege escalation via stored XSS using the file upload service to upload malicious content. The issue can be exploited only by authenticated users which can create directory name to inject some XSS content and gain some privileges such admin user.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-28158?
CVE-2023-28158 is a vulnerability that allows for privilege escalation through stored cross-site scripting (XSS) using the file upload service to upload malicious content.
Who can exploit CVE-2023-28158?
Only authenticated users with the ability to create directory names can exploit this vulnerability.
How does CVE-2023-28158 work?
Authenticated users can inject XSS content into directory names when using the file upload service, allowing them to gain elevated privileges such as admin user access.
What is the severity of CVE-2023-28158?
The severity of CVE-2023-28158 is medium, with a severity value of 5.4.
How can I mitigate CVE-2023-28158?
To mitigate CVE-2023-28158, ensure that all user-supplied input is properly validated and sanitized when creating directory names for the file upload service.