medium4.3
CVE-2022-40309
Apache Archiva subject to arbitrary directory deletion by users.
Impact
Apache Archiva prior to 2.2.9 allows an authenticated user to delete arbitrary directories. Users with write permissions to a repository can delete arbitrary directories.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.archiva:archiva-common | < 2.2.9 | 2.2.9 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Archiva | before 2.2.9 |