Description
Apache Archiva 在创建重置密码密钥时未对当前用户进行校验，导致未登录的用户可创建重置密码的密钥，而后重置任意用户的密码。
Apache Archiva 任意密码重置漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://zhuanlan.zhihu.com/p/555165686
https://blog.csdn.net/LJQClqjc/article/details/126363415
https://www.secevery.com/toBugInfo?id=1877292953661915138
http://www.chuanpuyun.com/article/8066.html
https://nvd.nist.gov/vuln/detail/CVE-2022-29405
https://archiva.apache.org/security.html
https://cve.imfht.com/detail/CVE-2022-29405?lang=en
https://github.com/advisories/GHSA-5hqc-x78w-3cmw
https://vuldb.com/vuln/200682