CVE-2011-1077: Apache Archiva Multiple XSS vulnerability Severity: High
Vendor: The Apache Software Foundation Versions Affected: Archiva 1.3.0 - 1.3.4 The unsupported versions Archiva 1.0 - 1.2.2 are also affected. Description: The multiple XSS issues found are both Stored (Persistent) and Reflected (Non-Persistent). Javascript which might contain malicious code can be appended in a request parameter or stored as a value in a submitted form, and get executed. Mitigation: Archiva 1.3.4 and earlier users should upgrade to 1.3.5 Credit: This issue was discovered by Riyaz Ahemed Walikar of Microland Ltd., India References: http://archiva.apache.org/security.html Thanks, The Apache Archiva Team
