org.apache.archiva:archiva-common (Maven) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Maven package org.apache.archiva:archiva-common, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (3)

• CVE-2022-40308 — CVSS 7.5 (high): If anonymous read enabled, it's possible to read the database file directly without logging in.
• CVE-2024-27140 — CVSS 5.4 (medium): ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in…
• CVE-2022-40309 — CVSS 4.3 (medium): Users with write permissions to a repository can delete arbitrary directories.