CVE-2024-27138

CVE-2024-27138: Apache Archiva: disabling user registration is not effective

Vendor Apache Software Foundation
Product Apache Archiva
Weakness CWE-863 · Incorrect authorization
Published March 1, 2024
Last update February 13, 2025

CVSS base score

What the vulnerability does

Description

** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva. Apache Archiva has a setting to disable user registration, however this restriction can be bypassed. As Apache Archiva has been retired, we do not expect to release a version of Apache Archiva that fixes this issue. You are recommended to look into migrating to a different solution, or isolate your instance from any untrusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Key dates

Disclosure timeline

March 1, 2024 CVE published
February 13, 2025 Record updated