CVE-2019-0213

In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e. the logo URL. The vulnerability is considered as minor risk, as only users with admin role can change the configuration, or the communication between the browser and the Archiva server must be compromised.

• CWE-79

• http://archiva.apache.org/security.html#CVE-2019-0213Vendor Advisory
• http://packetstormsecurity.com/files/152681/Apache-Archiva-2.2.3-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
• http://www.openwall.com/lists/oss-security/2019/04/30/7Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/108123Third Party Advisory, VDB Entry
• https://lists.apache.org/thread.html/0397ddbd17b5257cc1746b31a07294a87221c5ca24e5d19d390e28f3%40%3Cusers.archiva.apache.org%3E
• https://lists.apache.org/thread.html/7bcea134c3d6fa72cdc1052922ac0914f399f63f4690b7937b80127d%40%3Cannounce.apache.org%3E
• https://lists.apache.org/thread.html/ada0052409d8a4a8c4eb2c7fd6b9cd9423bc753d5fce87eb826662fb%40%3Cissues.archiva.apache.org%3E
• https://lists.apache.org/thread.html/c358754a35473a61477f9d487870581a0dd7054ff95974628fa09f97%40%3Cusers.maven.apache.org%3E
• https://seclists.org/bugtraq/2019/Apr/47Mailing List, Third Party Advisory
• http://archiva.apache.org/security.html#CVE-2019-0213Vendor Advisory
• http://packetstormsecurity.com/files/152681/Apache-Archiva-2.2.3-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
• http://www.openwall.com/lists/oss-security/2019/04/30/7Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/108123Third Party Advisory, VDB Entry
• https://lists.apache.org/thread.html/0397ddbd17b5257cc1746b31a07294a87221c5ca24e5d19d390e28f3%40%3Cusers.archiva.apache.org%3E
• https://lists.apache.org/thread.html/7bcea134c3d6fa72cdc1052922ac0914f399f63f4690b7937b80127d%40%3Cannounce.apache.org%3E
• https://lists.apache.org/thread.html/ada0052409d8a4a8c4eb2c7fd6b9cd9423bc753d5fce87eb826662fb%40%3Cissues.archiva.apache.org%3E
• https://lists.apache.org/thread.html/c358754a35473a61477f9d487870581a0dd7054ff95974628fa09f97%40%3Cusers.maven.apache.org%3E
• https://seclists.org/bugtraq/2019/Apr/47Mailing List, Third Party Advisory

Published

Apr 30, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-0207Tapestry processes assets `/assets/ctx` using classes chain …7.5
• CVE-2019-0208Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-0209Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-0210In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go…7.5
• CVE-2019-0211In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MP…7.8
• CVE-2019-0212In all previously released Apache HBase 2.x versions (2.0.0-…
• CVE-2019-0214In Apache Archiva 2.0.0 - 2.2.3, it is possible to write fil…
• CVE-2019-0215In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug …
• CVE-2019-0216A malicious admin user could edit the state of objects in th…
• CVE-2019-0217In Apache HTTP Server 2.4 release 2.4.38 and prior, a race c…7.5
• CVE-2019-0218A vulnerability was discovered wherein a specially crafted U…
• CVE-2019-0219A website running in the InAppBrowser webview on Android cou…9.8