Search criteria

5 vulnerabilities found for continuum by apache

CVE-2016-15057 (GCVE-0-2016-15057)

Vulnerability from nvd – Published: 2026-01-26 11:29 – Updated: 2026-01-26 18:06 Unsupported When Assigned
VLAI?
Title
Apache Continuum: Command injection leading to RCE
Summary
** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Continuum. This issue affects Apache Continuum: all versions. Attackers with access to the installations REST API can use this to invoke arbitrary commands on the server. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Severity ?
No CVSS data available.
CWE
  • CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
Impacted products
Vendor Product Version
Apache Software Foundation Apache Continuum Affected: 0 , < * (semver)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.9,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2016-15057",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-26T14:48:37.640113Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-26T14:49:40.287Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-26T18:06:06.158Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/01/26/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.continuum:continuum",
          "product": "Apache Continuum",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027) vulnerability in Apache Continuum.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Continuum: all versions.\u003c/p\u003e\u003cp\u003eAttackers with access to the installations REST API can use this to invoke arbitrary commands on the server.\u003c/p\u003e\u003cp\u003eAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\u003c/p\u003e\u003cp\u003eNOTE: This vulnerability only affects products that are no longer supported by the maintainer.\u003c/p\u003e"
            }
          ],
          "value": "** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027) vulnerability in Apache Continuum.\n\nThis issue affects Apache Continuum: all versions.\n\nAttackers with access to the installations REST API can use this to invoke arbitrary commands on the server.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-26T11:29:03.524Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/hbvf1ztqw2kv51khvzm5nk3mml3nm4z1"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "unsupported-when-assigned"
      ],
      "title": "Apache Continuum: Command injection leading to RCE",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2016-15057",
    "datePublished": "2026-01-26T11:29:03.524Z",
    "dateReserved": "2026-01-23T11:27:11.437Z",
    "dateUpdated": "2026-01-26T18:06:06.158Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2011-0533 (GCVE-0-2011-0533)

Vulnerability from nvd – Published: 2011-02-17 17:00 – Updated: 2024-08-06 21:58
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta; and Archiva 1.3.0 through 1.3.3 and 1.0 through 1.22 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to the autoIncludeParameters setting for the extremecomponents table.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://osvdb.org/70925 vdb-entryx_refsource_OSVDB
http://svn.apache.org/viewvc?view=revision&revisi… x_refsource_CONFIRM
http://www.securityfocus.com/bid/46311 vdb-entryx_refsource_BID
http://secunia.com/advisories/43261 third-party-advisoryx_refsource_SECUNIA
http://jira.codehaus.org/browse/CONTINUUM-2604 x_refsource_CONFIRM
http://mail-archives.apache.org/mod_mbox/continuu… mailing-listx_refsource_MLIST
http://www.vupen.com/english/advisories/2011/0373 vdb-entryx_refsource_VUPEN
http://securitytracker.com/id?1025065 vdb-entryx_refsource_SECTRACK
http://www.securityfocus.com/archive/1/516474/100… mailing-listx_refsource_BUGTRAQ
https://oval.cisecurity.org/repository/search/def… vdb-entrysignaturex_refsource_OVAL
http://securityreason.com/securityalert/8091 third-party-advisoryx_refsource_SREASON
http://svn.apache.org/viewvc?view=revision&revisi… x_refsource_CONFIRM
http://www.vupen.com/english/advisories/2011/0426 vdb-entryx_refsource_VUPEN
http://secunia.com/advisories/43334 third-party-advisoryx_refsource_SECUNIA
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://www.securityfocus.com/archive/1/516342/100… mailing-listx_refsource_BUGTRAQ
http://continuum.apache.org/security.html x_refsource_CONFIRM
http://seclists.org/fulldisclosure/2011/Feb/236 mailing-listx_refsource_FULLDISC
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T21:58:25.087Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "70925",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/70925"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066056"
          },
          {
            "name": "46311",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/46311"
          },
          {
            "name": "43261",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/43261"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://jira.codehaus.org/browse/CONTINUUM-2604"
          },
          {
            "name": "[continuum-users] 20110210 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://mail-archives.apache.org/mod_mbox/continuum-users/201102.mbox/%3C981C0A79-5B7B-4053-84CC-3217870BE360%40apache.org%3E"
          },
          {
            "name": "ADV-2011-0373",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2011/0373"
          },
          {
            "name": "1025065",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1025065"
          },
          {
            "name": "20110216 [SECURITY] CVE-2011-0533: Apache Archiva cross-site scripting vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/516474/100/0/threaded"
          },
          {
            "name": "oval:org.mitre.oval:def:12581",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12581"
          },
          {
            "name": "8091",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/8091"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066053"
          },
          {
            "name": "ADV-2011-0426",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2011/0426"
          },
          {
            "name": "43334",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/43334"
          },
          {
            "name": "continuum-unspec-xss(65343)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65343"
          },
          {
            "name": "20110210 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/516342/100/0/threaded"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://continuum.apache.org/security.html"
          },
          {
            "name": "20110211 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2011/Feb/236"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-02-10T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta; and Archiva 1.3.0 through 1.3.3 and 1.0 through 1.22 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to the autoIncludeParameters setting for the extremecomponents table."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-09T18:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "70925",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/70925"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066056"
        },
        {
          "name": "46311",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/46311"
        },
        {
          "name": "43261",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/43261"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://jira.codehaus.org/browse/CONTINUUM-2604"
        },
        {
          "name": "[continuum-users] 20110210 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://mail-archives.apache.org/mod_mbox/continuum-users/201102.mbox/%3C981C0A79-5B7B-4053-84CC-3217870BE360%40apache.org%3E"
        },
        {
          "name": "ADV-2011-0373",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2011/0373"
        },
        {
          "name": "1025065",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1025065"
        },
        {
          "name": "20110216 [SECURITY] CVE-2011-0533: Apache Archiva cross-site scripting vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/516474/100/0/threaded"
        },
        {
          "name": "oval:org.mitre.oval:def:12581",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12581"
        },
        {
          "name": "8091",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/8091"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066053"
        },
        {
          "name": "ADV-2011-0426",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2011/0426"
        },
        {
          "name": "43334",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/43334"
        },
        {
          "name": "continuum-unspec-xss(65343)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65343"
        },
        {
          "name": "20110210 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/516342/100/0/threaded"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://continuum.apache.org/security.html"
        },
        {
          "name": "20110211 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2011/Feb/236"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2011-0533",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta; and Archiva 1.3.0 through 1.3.3 and 1.0 through 1.22 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to the autoIncludeParameters setting for the extremecomponents table."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "70925",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/70925"
            },
            {
              "name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066056",
              "refsource": "CONFIRM",
              "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066056"
            },
            {
              "name": "46311",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/46311"
            },
            {
              "name": "43261",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/43261"
            },
            {
              "name": "http://jira.codehaus.org/browse/CONTINUUM-2604",
              "refsource": "CONFIRM",
              "url": "http://jira.codehaus.org/browse/CONTINUUM-2604"
            },
            {
              "name": "[continuum-users] 20110210 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
              "refsource": "MLIST",
              "url": "http://mail-archives.apache.org/mod_mbox/continuum-users/201102.mbox/%3C981C0A79-5B7B-4053-84CC-3217870BE360@apache.org%3E"
            },
            {
              "name": "ADV-2011-0373",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2011/0373"
            },
            {
              "name": "1025065",
              "refsource": "SECTRACK",
              "url": "http://securitytracker.com/id?1025065"
            },
            {
              "name": "20110216 [SECURITY] CVE-2011-0533: Apache Archiva cross-site scripting vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/516474/100/0/threaded"
            },
            {
              "name": "oval:org.mitre.oval:def:12581",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12581"
            },
            {
              "name": "8091",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/8091"
            },
            {
              "name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066053",
              "refsource": "CONFIRM",
              "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066053"
            },
            {
              "name": "ADV-2011-0426",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2011/0426"
            },
            {
              "name": "43334",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/43334"
            },
            {
              "name": "continuum-unspec-xss(65343)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65343"
            },
            {
              "name": "20110210 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/516342/100/0/threaded"
            },
            {
              "name": "http://continuum.apache.org/security.html",
              "refsource": "CONFIRM",
              "url": "http://continuum.apache.org/security.html"
            },
            {
              "name": "20110211 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2011/Feb/236"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2011-0533",
    "datePublished": "2011-02-17T17:00:00",
    "dateReserved": "2011-01-20T00:00:00",
    "dateUpdated": "2024-08-06T21:58:25.087Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-15057 (GCVE-0-2016-15057)

Vulnerability from cvelistv5 – Published: 2026-01-26 11:29 – Updated: 2026-01-26 18:06 Unsupported When Assigned
VLAI?
Title
Apache Continuum: Command injection leading to RCE
Summary
** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Continuum. This issue affects Apache Continuum: all versions. Attackers with access to the installations REST API can use this to invoke arbitrary commands on the server. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Severity ?
No CVSS data available.
CWE
  • CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
Impacted products
Vendor Product Version
Apache Software Foundation Apache Continuum Affected: 0 , < * (semver)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.9,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2016-15057",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-26T14:48:37.640113Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-26T14:49:40.287Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-26T18:06:06.158Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/01/26/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.continuum:continuum",
          "product": "Apache Continuum",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027) vulnerability in Apache Continuum.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Continuum: all versions.\u003c/p\u003e\u003cp\u003eAttackers with access to the installations REST API can use this to invoke arbitrary commands on the server.\u003c/p\u003e\u003cp\u003eAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\u003c/p\u003e\u003cp\u003eNOTE: This vulnerability only affects products that are no longer supported by the maintainer.\u003c/p\u003e"
            }
          ],
          "value": "** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027) vulnerability in Apache Continuum.\n\nThis issue affects Apache Continuum: all versions.\n\nAttackers with access to the installations REST API can use this to invoke arbitrary commands on the server.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-26T11:29:03.524Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/hbvf1ztqw2kv51khvzm5nk3mml3nm4z1"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "unsupported-when-assigned"
      ],
      "title": "Apache Continuum: Command injection leading to RCE",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2016-15057",
    "datePublished": "2026-01-26T11:29:03.524Z",
    "dateReserved": "2026-01-23T11:27:11.437Z",
    "dateUpdated": "2026-01-26T18:06:06.158Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2011-0533 (GCVE-0-2011-0533)

Vulnerability from cvelistv5 – Published: 2011-02-17 17:00 – Updated: 2024-08-06 21:58
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta; and Archiva 1.3.0 through 1.3.3 and 1.0 through 1.22 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to the autoIncludeParameters setting for the extremecomponents table.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://osvdb.org/70925 vdb-entryx_refsource_OSVDB
http://svn.apache.org/viewvc?view=revision&revisi… x_refsource_CONFIRM
http://www.securityfocus.com/bid/46311 vdb-entryx_refsource_BID
http://secunia.com/advisories/43261 third-party-advisoryx_refsource_SECUNIA
http://jira.codehaus.org/browse/CONTINUUM-2604 x_refsource_CONFIRM
http://mail-archives.apache.org/mod_mbox/continuu… mailing-listx_refsource_MLIST
http://www.vupen.com/english/advisories/2011/0373 vdb-entryx_refsource_VUPEN
http://securitytracker.com/id?1025065 vdb-entryx_refsource_SECTRACK
http://www.securityfocus.com/archive/1/516474/100… mailing-listx_refsource_BUGTRAQ
https://oval.cisecurity.org/repository/search/def… vdb-entrysignaturex_refsource_OVAL
http://securityreason.com/securityalert/8091 third-party-advisoryx_refsource_SREASON
http://svn.apache.org/viewvc?view=revision&revisi… x_refsource_CONFIRM
http://www.vupen.com/english/advisories/2011/0426 vdb-entryx_refsource_VUPEN
http://secunia.com/advisories/43334 third-party-advisoryx_refsource_SECUNIA
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://www.securityfocus.com/archive/1/516342/100… mailing-listx_refsource_BUGTRAQ
http://continuum.apache.org/security.html x_refsource_CONFIRM
http://seclists.org/fulldisclosure/2011/Feb/236 mailing-listx_refsource_FULLDISC
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T21:58:25.087Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "70925",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/70925"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066056"
          },
          {
            "name": "46311",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/46311"
          },
          {
            "name": "43261",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/43261"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://jira.codehaus.org/browse/CONTINUUM-2604"
          },
          {
            "name": "[continuum-users] 20110210 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://mail-archives.apache.org/mod_mbox/continuum-users/201102.mbox/%3C981C0A79-5B7B-4053-84CC-3217870BE360%40apache.org%3E"
          },
          {
            "name": "ADV-2011-0373",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2011/0373"
          },
          {
            "name": "1025065",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1025065"
          },
          {
            "name": "20110216 [SECURITY] CVE-2011-0533: Apache Archiva cross-site scripting vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/516474/100/0/threaded"
          },
          {
            "name": "oval:org.mitre.oval:def:12581",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12581"
          },
          {
            "name": "8091",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/8091"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066053"
          },
          {
            "name": "ADV-2011-0426",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2011/0426"
          },
          {
            "name": "43334",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/43334"
          },
          {
            "name": "continuum-unspec-xss(65343)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65343"
          },
          {
            "name": "20110210 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/516342/100/0/threaded"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://continuum.apache.org/security.html"
          },
          {
            "name": "20110211 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2011/Feb/236"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-02-10T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta; and Archiva 1.3.0 through 1.3.3 and 1.0 through 1.22 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to the autoIncludeParameters setting for the extremecomponents table."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-09T18:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "70925",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/70925"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066056"
        },
        {
          "name": "46311",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/46311"
        },
        {
          "name": "43261",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/43261"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://jira.codehaus.org/browse/CONTINUUM-2604"
        },
        {
          "name": "[continuum-users] 20110210 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://mail-archives.apache.org/mod_mbox/continuum-users/201102.mbox/%3C981C0A79-5B7B-4053-84CC-3217870BE360%40apache.org%3E"
        },
        {
          "name": "ADV-2011-0373",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2011/0373"
        },
        {
          "name": "1025065",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1025065"
        },
        {
          "name": "20110216 [SECURITY] CVE-2011-0533: Apache Archiva cross-site scripting vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/516474/100/0/threaded"
        },
        {
          "name": "oval:org.mitre.oval:def:12581",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12581"
        },
        {
          "name": "8091",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/8091"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066053"
        },
        {
          "name": "ADV-2011-0426",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2011/0426"
        },
        {
          "name": "43334",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/43334"
        },
        {
          "name": "continuum-unspec-xss(65343)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65343"
        },
        {
          "name": "20110210 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/516342/100/0/threaded"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://continuum.apache.org/security.html"
        },
        {
          "name": "20110211 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2011/Feb/236"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2011-0533",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta; and Archiva 1.3.0 through 1.3.3 and 1.0 through 1.22 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to the autoIncludeParameters setting for the extremecomponents table."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "70925",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/70925"
            },
            {
              "name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066056",
              "refsource": "CONFIRM",
              "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066056"
            },
            {
              "name": "46311",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/46311"
            },
            {
              "name": "43261",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/43261"
            },
            {
              "name": "http://jira.codehaus.org/browse/CONTINUUM-2604",
              "refsource": "CONFIRM",
              "url": "http://jira.codehaus.org/browse/CONTINUUM-2604"
            },
            {
              "name": "[continuum-users] 20110210 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
              "refsource": "MLIST",
              "url": "http://mail-archives.apache.org/mod_mbox/continuum-users/201102.mbox/%3C981C0A79-5B7B-4053-84CC-3217870BE360@apache.org%3E"
            },
            {
              "name": "ADV-2011-0373",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2011/0373"
            },
            {
              "name": "1025065",
              "refsource": "SECTRACK",
              "url": "http://securitytracker.com/id?1025065"
            },
            {
              "name": "20110216 [SECURITY] CVE-2011-0533: Apache Archiva cross-site scripting vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/516474/100/0/threaded"
            },
            {
              "name": "oval:org.mitre.oval:def:12581",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12581"
            },
            {
              "name": "8091",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/8091"
            },
            {
              "name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066053",
              "refsource": "CONFIRM",
              "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066053"
            },
            {
              "name": "ADV-2011-0426",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2011/0426"
            },
            {
              "name": "43334",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/43334"
            },
            {
              "name": "continuum-unspec-xss(65343)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65343"
            },
            {
              "name": "20110210 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/516342/100/0/threaded"
            },
            {
              "name": "http://continuum.apache.org/security.html",
              "refsource": "CONFIRM",
              "url": "http://continuum.apache.org/security.html"
            },
            {
              "name": "20110211 [SECURITY] CVE-2011-0533: Apache Continuum cross-site scripting vulnerability",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2011/Feb/236"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2011-0533",
    "datePublished": "2011-02-17T17:00:00",
    "dateReserved": "2011-01-20T00:00:00",
    "dateUpdated": "2024-08-06T21:58:25.087Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

FKIE_CVE-2011-0533

Vulnerability from fkie_nvd - Published: 2011-02-17 18:00 - Updated: 2025-04-11 00:51
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta; and Archiva 1.3.0 through 1.3.3 and 1.0 through 1.22 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to the autoIncludeParameters setting for the extremecomponents table.
References
secalert@redhat.comhttp://continuum.apache.org/security.html
secalert@redhat.comhttp://jira.codehaus.org/browse/CONTINUUM-2604
secalert@redhat.comhttp://mail-archives.apache.org/mod_mbox/continuum-users/201102.mbox/%3C981C0A79-5B7B-4053-84CC-3217870BE360%40apache.org%3E
secalert@redhat.comhttp://osvdb.org/70925
secalert@redhat.comhttp://seclists.org/fulldisclosure/2011/Feb/236Patch
secalert@redhat.comhttp://secunia.com/advisories/43261Vendor Advisory
secalert@redhat.comhttp://secunia.com/advisories/43334Vendor Advisory
secalert@redhat.comhttp://securityreason.com/securityalert/8091
secalert@redhat.comhttp://securitytracker.com/id?1025065
secalert@redhat.comhttp://svn.apache.org/viewvc?view=revision&revision=1066053Patch
secalert@redhat.comhttp://svn.apache.org/viewvc?view=revision&revision=1066056Patch
secalert@redhat.comhttp://www.securityfocus.com/archive/1/516342/100/0/threaded
secalert@redhat.comhttp://www.securityfocus.com/archive/1/516474/100/0/threaded
secalert@redhat.comhttp://www.securityfocus.com/bid/46311
secalert@redhat.comhttp://www.vupen.com/english/advisories/2011/0373Vendor Advisory
secalert@redhat.comhttp://www.vupen.com/english/advisories/2011/0426Vendor Advisory
secalert@redhat.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/65343
secalert@redhat.comhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12581
af854a3a-2127-422b-91ae-364da2661108http://continuum.apache.org/security.html
af854a3a-2127-422b-91ae-364da2661108http://jira.codehaus.org/browse/CONTINUUM-2604
af854a3a-2127-422b-91ae-364da2661108http://mail-archives.apache.org/mod_mbox/continuum-users/201102.mbox/%3C981C0A79-5B7B-4053-84CC-3217870BE360%40apache.org%3E
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/70925
af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2011/Feb/236Patch
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/43261Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/43334Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/8091
af854a3a-2127-422b-91ae-364da2661108http://securitytracker.com/id?1025065
af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1066053Patch
af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1066056Patch
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/516342/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/516474/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/46311
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2011/0373Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2011/0426Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/65343
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12581
Impacted products
Vendor Product Version
apache continuum 1.1
apache continuum 1.2
apache continuum 1.2.2
apache continuum 1.2.3
apache continuum 1.2.3.1
apache continuum 1.3.6
apache continuum 1.4.0
apache archiva 1.0
apache archiva 1.0.1
apache archiva 1.0.2
apache archiva 1.0.3
apache archiva 1.1
apache archiva 1.1.1
apache archiva 1.1.2
apache archiva 1.1.3
apache archiva 1.1.4
apache archiva 1.2
apache archiva 1.2.1
apache archiva 1.2.2
apache archiva 1.3
apache archiva 1.3.1
apache archiva 1.3.2
apache archiva 1.3.3
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:continuum:1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "117CA011-B3D9-4A0B-B9D4-3CCADA18C880",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:continuum:1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "2B9378F8-FEE0-4044-BFDD-609B9EF63FC1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:continuum:1.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "29D35B80-7257-4F31-95CE-4A5D246BB949",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:continuum:1.2.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "93FC5BC1-4022-433C-80A8-369F9658BB76",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:continuum:1.2.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "0189E53C-113E-4A38-8CAC-C0D536797AF6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:continuum:1.3.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "1BBBB14F-9048-4D92-B712-2DB48FB0F54B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:continuum:1.4.0:beta:*:*:*:*:*:*",
              "matchCriteriaId": "94C2C439-588B-457F-B66C-577FC5DBAB5E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:archiva:1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DFD6FB90-E505-48D6-B9D1-3E8DD3A47234",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:archiva:1.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "21DF9796-959A-4566-8AEF-16ABD8E36444",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:archiva:1.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "08C7B72C-957A-44FA-BABA-03A7E4CEF36A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:archiva:1.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "5CFEDC8F-0FE0-4E69-8F6F-BD49AB46D8CF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:archiva:1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "6FF7D312-B1C1-400B-AF0C-7375B1B3F0E0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:archiva:1.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "31357E13-6571-4FE9-A5E0-2CACE0423C2B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:archiva:1.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "ED2E53F7-845B-4077-9AC9-EAAE60ADC75A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:archiva:1.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "CF420D40-A4BE-4B74-9457-01E1FFF9D9A0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:archiva:1.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "B1389E21-2451-45FF-97C3-87B58A496E64",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:archiva:1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "DC7E1832-3889-477D-9DA4-869B6867EBC3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:archiva:1.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "F945FF3A-483C-4CD5-A413-0C354C15A99F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:archiva:1.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "CCCF9A1C-7091-4D72-8AFC-5373F45FF7D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:archiva:1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D1D107D-C022-43B4-BA64-0D39F31EE226",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:archiva:1.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "F26131F0-693E-4245-9DC1-645B0EACD0D8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:archiva:1.3.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "FEC394AE-2522-476B-82A9-5F7410B55398",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:archiva:1.3.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "C14AFD31-A944-4422-A142-AE95AD8E1424",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta; and Archiva 1.3.0 through 1.3.3 and 1.0 through 1.22 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to the autoIncludeParameters setting for the extremecomponents table."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de tipo cross-site scripting (XSS) en Continuum versiones 1.1 hasta 1.2.3.1, versiones 1.3.6 y 1.4.0 Beta; y Archiva versiones 1.3.0 hasta 1.3.3 y versiones 1.0 hasta 1.22 de Apache, permite a los atacantes remotos inyectar script web o HTML arbitrario por medio de un par\u00e1metro especialmente dise\u00f1ado, relacionado con la configuraci\u00f3n autoIncludeParameters para la tabla extremecomponents."
    }
  ],
  "id": "CVE-2011-0533",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2011-02-17T18:00:03.760",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "http://continuum.apache.org/security.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://jira.codehaus.org/browse/CONTINUUM-2604"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://mail-archives.apache.org/mod_mbox/continuum-users/201102.mbox/%3C981C0A79-5B7B-4053-84CC-3217870BE360%40apache.org%3E"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://osvdb.org/70925"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "http://seclists.org/fulldisclosure/2011/Feb/236"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/43261"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/43334"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://securityreason.com/securityalert/8091"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://securitytracker.com/id?1025065"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066053"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066056"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securityfocus.com/archive/1/516342/100/0/threaded"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securityfocus.com/archive/1/516474/100/0/threaded"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securityfocus.com/bid/46311"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2011/0373"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2011/0426"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65343"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12581"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://continuum.apache.org/security.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://jira.codehaus.org/browse/CONTINUUM-2604"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://mail-archives.apache.org/mod_mbox/continuum-users/201102.mbox/%3C981C0A79-5B7B-4053-84CC-3217870BE360%40apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/70925"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://seclists.org/fulldisclosure/2011/Feb/236"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/43261"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/43334"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/8091"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securitytracker.com/id?1025065"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066053"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1066056"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/516342/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/516474/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/46311"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2011/0373"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2011/0426"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65343"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12581"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}