Vulnerabilities in pkg:maven/org.apache.archiva/archiva

Q: What is CVE-2011-0533?

CVE-2011-0533 is a security vulnerability in Archiva involving Apache Continuum and Archiva vulnerable to Cross-site Scripting under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').

Q: Which Archiva versions are affected?

Affected versions include releases prior to 1.3.4, 1.3.7 across affected packages: org.apache.archiva:archiva, org.apache.continuum:continuum.

Q: What version fixes CVE-2011-0533?

Upgrading to 1.3.4, 1.3.7 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is archiva affected?

Yes, org.apache.archiva:archiva is affected in releases prior to 1.3.4. Upgrade your dependency to 1.3.4 or later.

Q: Is continuum affected?

Yes, org.apache.continuum:continuum is affected in releases prior to 1.3.7, Latest secure release. Upgrade your dependency to 1.3.7, Latest secure release or later.

Q: What CWE is associated with CVE-2011-0533?

CVE-2011-0533 is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.).

Q: How can I check Maven dependencies for CVE-2011-0533?

Run the dependency tree command: 'mvn dependency:tree -Dincludes=org.apache.archiva'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

PACKAGE

Advisory Identifier: GHSA-7382-fv7p-v9v3

Advisory Summary

CVE-2011-0533 is a MODERATE cross-site scripting vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) affecting Archiva libraries in the Maven ecosystem. The issue involves apache continuum and archiva vulnerable to cross-site scripting. Remediation is available by upgrading affected packages to version 1.3.4, 1.3.7.

11 Known Advisory Record(s)

Package Vulnerability Intelligence

pkg:maven/org.apache.archiva/archiva

11 Known Advisory Record(s)

Vulnerability advisories affecting package pkg:maven/org.apache.archiva/archiva. Select an advisory below to view technical details or fixes.

Advisory ID	CVE / NVD	Severity	Summary
GHSA-7382-fv7p-v9v3	CVE-2011-0533	MODERATE	Apache Continuum and Archiva vulnerable to Cross-site Scripting
GHSA-5p54-jj38-3hxj	CVE-2010-4408	MODERATE	Apache Archiva does not require entry of the administrator's password at the time of modifying a user account
GHSA-rv4h-m4wc-v99w	CVE-2024-27138	HIGH	Apache Archiva Incorrect Authorization vulnerability
GHSA-h595-vwhc-3xwx	CVE-2024-27139	HIGH	Apache Archiva Incorrect Authorization vulnerability
GHSA-qf34-f43r-gv9p	CVE-2023-28158	MODERATE	Apache Archiva vulnerable to privilege escalation via stored cross-site scripting (XSS)
GHSA-hf4p-mhc8-x2gp	CVE-2017-5657	HIGH	Apache Archiva vulnerable to Cross Site Request Forgery
GHSA-8jfm-rgmg-3wq2	CVE-2016-5005	MODERATE	Apache Archiva vulnerable to Cross-site Scripting
GHSA-5hqc-x78w-3cmw	CVE-2022-29405	MODERATE	Missing Authorization in Apache Archiva
GHSA-jxgm-9f58-w4xp	CVE-2019-0214	MODERATE	Improper Input Validation in Apache Archiva
GHSA-v83p-xwm9-v4g8	CVE-2020-9495	MODERATE	Injection in Apache Archiva
GHSA-cqcf-4g4h-rghf	CVE-2019-0213	MODERATE	Cross-site scripting in Apache Archiva

CVE-2011-0533 at a Glance

CVE Identifier CVE-2011-0533

GHSA Identifier GHSA-7382-fv7p-v9v3

Severity MODERATE

CVSS v3.1 Base Score N/A

CWE Classification CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Product Archiva

Package Ecosystem Maven

Published Date 2022-05-14

Last Updated 2025-04-12

How to Fix CVE-2011-0533

To remediate this vulnerability, upgrade all affected Archiva dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

org.apache.archiva:archiva fixed: 1.3.4

<dependency>
    <groupId>org.apache.archiva</groupId>
    <artifactId>archiva</artifactId>
    <version>1.3.4</version>
</dependency>

org.apache.continuum:continuum fixed: 1.3.7

<dependency>
    <groupId>org.apache.continuum</groupId>
    <artifactId>continuum</artifactId>
    <version>1.3.7</version>
</dependency>

org.apache.continuum:continuum fixed: Latest secure release

<dependency>
    <groupId>org.apache.continuum</groupId>
    <artifactId>continuum</artifactId>
    <version>Latest secure release</version>
</dependency>

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

mvn dependency:tree -Dincludes=org.apache.archiva

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2011-0533, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree -Dincludes=org.apache.archiva

Analyze the terminal output to locate any version of Archiva in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.3.4), your application is affected.

Note: The mvn dependency:tree -Dincludes=org.apache.archiva command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), where the product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. In Archiva, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta; and Archiva 1.3.0 through 1.3.3 and 1.0 through 1.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to the autoIncludeParameters setting for the extremecomponents table.

CVE-2011-0533 Affected Archiva Versions

3 component(s)

Fixed Versions:

1.3.41.3.7

Product / Package	Ecosystem	Affected Versions	Fixed Version
org.apache.archiva:archiva maven/org.apache.archiva/archiva	Maven	≥ 1.0 < 1.3.4	1.3.4
org.apache.continuum:continuum maven/org.apache.continuum/continuum	Maven	≥ 1.1 < 1.3.7	1.3.7
org.apache.continuum:continuum maven/org.apache.continuum/continuum	Maven	1.4.0-beta All 1 versions 1.4.0-beta	None specified

References

NVD — CVE-2011-0533 NVD

https://nvd.nist.gov/vuln/detail/CVE-2011-0533

exchange.xforce.ibmcloud.com/vulnerabilities/653... WEB

https://exchange.xforce.ibmcloud.com/vulnerabilities/65343

Archiva Security Information SECURITY

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12581

Archiva Security Information SECURITY

https://web.archive.org/web/20110308092332/http://securitytracker.com/id?1025065

Archiva Security Information SECURITY

https://web.archive.org/web/20111008021907/http://securityreason.com/securityalert/8091

Archiva Security Information SECURITY

https://web.archive.org/web/20200229160845/http://www.securityfocus.com/bid/46311

Archiva Security Information SECURITY

https://web.archive.org/web/20201207190531/http://www.securityfocus.com/archive/1/516342/100/0/threaded

Archiva Security Information SECURITY

https://web.archive.org/web/20201207190533/http://www.securityfocus.com/archive/1/516474/100/0/threaded

Archiva Security Information SECURITY

http://continuum.apache.org/security.html

jira.codehaus.org/browse/continuum-26... WEB

http://jira.codehaus.org/browse/CONTINUUM-2604

mail-archives.apache.org/mod_mbox/continuum-... WEB

http://mail-archives.apache.org/mod_mbox/continuum-users/201102.mbox/%3C981C0A79-5B7B-4053-84CC-3217870BE360%40apache.org%3E

mail-archives.apache.org/mod_mbox/continuum-... WEB

http://mail-archives.apache.org/mod_mbox/continuum-users/201102.mbox/%3C981C0A79-5B7B-4053-84CC-3217870BE360@apache.org%3E

seclists.org/fulldisclosure/2011... WEB

http://seclists.org/fulldisclosure/2011/Feb/236

svn.apache.org/viewvc WEB

http://svn.apache.org/viewvc?view=revision&revision=1066053

svn.apache.org/viewvc WEB

http://svn.apache.org/viewvc?view=revision&revision=1066056

Frequently Asked Questions

What is CVE-2011-0533?

CVE-2011-0533 is a security vulnerability in Archiva involving Apache Continuum and Archiva vulnerable to Cross-site Scripting under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').

Which Archiva versions are affected?

Affected versions include releases prior to 1.3.4, 1.3.7 across affected packages: org.apache.archiva:archiva, org.apache.continuum:continuum.

What version fixes CVE-2011-0533?

Upgrading to 1.3.4, 1.3.7 (or the latest patched release for your respective branch) resolves the vulnerability.

Is archiva affected?

Yes, org.apache.archiva:archiva is affected in releases prior to 1.3.4. Upgrade your dependency to 1.3.4 or later.

Is continuum affected?

Yes, org.apache.continuum:continuum is affected in releases prior to 1.3.7, Latest secure release. Upgrade your dependency to 1.3.7, Latest secure release or later.

What CWE is associated with CVE-2011-0533?

CVE-2011-0533 is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.).

How can I check Maven dependencies for CVE-2011-0533?

Run the dependency tree command: 'mvn dependency:tree -Dincludes=org.apache.archiva'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-7382-fv7p-v9v3",
  "modified" : "2025-04-12T01:47:49Z",
  "published" : "2022-05-14T02:56:35Z",
  "aliases" : [ "CVE-2011-0533" ],
  "summary" : "Apache Continuum and Archiva vulnerable to Cross-site Scripting",
  "details" : "Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta; and Archiva 1.3.0 through 1.3.3 and 1.0 through 1.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to the autoIncludeParameters setting for the extremecomponents table.",
  "severity" : [ ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.archiva:archiva"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.0"
      }, {
        "fixed" : "1.3.4"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.continuum:continuum"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.1"
      }, {
        "fixed" : "1.3.7"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.continuum:continuum"
    },
    "versions" : [ "1.4.0-beta" ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2011-0533"
  }, {
    "type" : "WEB",
    "url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/65343"
  }, {
    "type" : "WEB",
    "url" : "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12581"
  }, {
    "type" : "WEB",
    "url" : "https://web.archive.org/web/20110308092332/http://securitytracker.com/id?1025065"
  }, {
    "type" : "WEB",
    "url" : "https://web.archive.org/web/20111008021907/http://securityreason.com/securityalert/8091"
  }, {
    "type" : "WEB",
    "url" : "https://web.archive.org/web/20200229160845/http://www.securityfocus.com/bid/46311"
  }, {
    "type" : "WEB",
    "url" : "https://web.archive.org/web/20201207190531/http://www.securityfocus.com/archive/1/516342/100/0/threaded"
  }, {
    "type" : "WEB",
    "url" : "https://web.archive.org/web/20201207190533/http://www.securityfocus.com/archive/1/516474/100/0/threaded"
  }, {
    "type" : "WEB",
    "url" : "http://continuum.apache.org/security.html"
  }, {
    "type" : "WEB",
    "url" : "http://jira.codehaus.org/browse/CONTINUUM-2604"
  }, {
    "type" : "WEB",
    "url" : "http://mail-archives.apache.org/mod_mbox/continuum-users/201102.mbox/%3C981C0A79-5B7B-4053-84CC-3217870BE360%40apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "http://mail-archives.apache.org/mod_mbox/continuum-users/201102.mbox/%3C981C0A79-5B7B-4053-84CC-3217870BE360@apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "http://seclists.org/fulldisclosure/2011/Feb/236"
  }, {
    "type" : "WEB",
    "url" : "http://svn.apache.org/viewvc?view=revision&revision=1066053"
  }, {
    "type" : "WEB",
    "url" : "http://svn.apache.org/viewvc?view=revision&revision=1066056"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-04-12T01:47:49Z",
    "nvd_published_at" : "2011-02-17T18:00:00Z"
  }
}

Advisory Metadata

Source ID: GHSA-7382-fv7p-v9v3
Schema Version: 1.4.0
Published: 2022-05-14 02:56
Last Modified: 2025-04-12 01:47
Database Record File: advisories/github-reviewed/2022/05/GHSA-7382-fv7p-v9v3/GHSA-7382-fv7p-v9v3.json