CVE-2022-40308

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-40308
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-40308.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-40308
Aliases
Published
2022-11-15T00:00:00Z
Modified
2026-08-12T03:51:22Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Apache Archiva prior to 2.2.9 may allow the anonymous user to read arbitrary files
Details

If anonymous read enabled, it's possible to read the database file directly without logging in.

Database specific 
{
    "cna_assigner": "apache",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/40xxx/CVE-2022-40308.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "Apache Archiva"
                },
                {
                    "last_affected": "2.2.8"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/apache/archiva

Affected ranges

Type
GIT
Repo
https://github.com/apache/archiva
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f8e7fc29cff887f0ac58128e95b0fba5edc0035d
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:apache:archiva:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.2.9"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

archiva-2.*
archiva-2.1.0
archiva-2.1.1
archiva-2.2.0
archiva-2.2.1
archiva-2.2.2
archiva-2.2.3
archiva-2.2.4
archiva-2.2.5
archiva-2.2.6
archiva-2.2.7
archiva-2.2.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-40308.json"