CVE-2019-0214

In Apache Archiva 2.0.0 - 2.2.3, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mechanism. Existing files can be overwritten, if the archiva run user has appropriate permission on the filesystem for the target file.

• http://archiva.apache.org/security.html#CVE-2019-0214Vendor Advisory
• http://packetstormsecurity.com/files/152684/Apache-Archiva-2.2.3-File-Write-Delete.htmlMitigation, Third Party Advisory, VDB Entry
• http://www.openwall.com/lists/oss-security/2019/04/30/8Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/108124Third Party Advisory, VDB Entry
• https://lists.apache.org/thread.html/18b670afc2f83034f47ebeb2f797c350fe60f1f2b33c95b95f467ef8%40%3Cannounce.apache.org%3E
• https://lists.apache.org/thread.html/239349b6dd8f66cf87a70c287b03af451dea158b776d3dfc550b4f0e%40%3Cusers.maven.apache.org%3E
• https://lists.apache.org/thread.html/5851cb0214f22ba681fb445870eeb6b01afd1fb614e45a22978d7dda%40%3Cusers.archiva.apache.org%3E
• https://lists.apache.org/thread.html/ada0052409d8a4a8c4eb2c7fd6b9cd9423bc753d5fce87eb826662fb%40%3Cissues.archiva.apache.org%3E
• https://seclists.org/bugtraq/2019/Apr/48Mailing List, Third Party Advisory
• http://archiva.apache.org/security.html#CVE-2019-0214Vendor Advisory
• http://packetstormsecurity.com/files/152684/Apache-Archiva-2.2.3-File-Write-Delete.htmlMitigation, Third Party Advisory, VDB Entry
• http://www.openwall.com/lists/oss-security/2019/04/30/8Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/108124Third Party Advisory, VDB Entry
• https://lists.apache.org/thread.html/18b670afc2f83034f47ebeb2f797c350fe60f1f2b33c95b95f467ef8%40%3Cannounce.apache.org%3E
• https://lists.apache.org/thread.html/239349b6dd8f66cf87a70c287b03af451dea158b776d3dfc550b4f0e%40%3Cusers.maven.apache.org%3E
• https://lists.apache.org/thread.html/5851cb0214f22ba681fb445870eeb6b01afd1fb614e45a22978d7dda%40%3Cusers.archiva.apache.org%3E
• https://lists.apache.org/thread.html/ada0052409d8a4a8c4eb2c7fd6b9cd9423bc753d5fce87eb826662fb%40%3Cissues.archiva.apache.org%3E
• https://seclists.org/bugtraq/2019/Apr/48Mailing List, Third Party Advisory

Published

Apr 30, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-0208Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-0209Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-0210In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go…7.5
• CVE-2019-0211In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MP…7.8
• CVE-2019-0212In all previously released Apache HBase 2.x versions (2.0.0-…
• CVE-2019-0213In Apache Archiva before 2.2.4, it may be possible to store …
• CVE-2019-0215In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug …
• CVE-2019-0216A malicious admin user could edit the state of objects in th…
• CVE-2019-0217In Apache HTTP Server 2.4 release 2.4.38 and prior, a race c…7.5
• CVE-2019-0218A vulnerability was discovered wherein a specially crafted U…
• CVE-2019-0219A website running in the InAppBrowser webview on Android cou…9.8
• CVE-2019-0220A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4…