PT-2016-5046 · Apache · Apache Jetspeed

Andreas Lindh · Publicado 2016-04-11 · Atualizado 2016-04-14 · CVE-2016-2171

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Jetspeed versions prior to 2.3.1

Description The issue concerns the User Manager service in Apache Jetspeed, which fails to properly restrict access using Jetspeed Security. This allows remote attackers to perform unauthorized actions on users via the REST API, including adding, editing, or deleting users.

Recommendations For versions prior to 2.3.1, update to version 2.3.1 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2016-2171

Produtos afetados

Apache Jetspeed

Referências · 5

• https://osv.dev/vulnerability/CVE-2016-2171 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-2171 · Nota de Segurança
• http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-and · Nota
• https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-2171 · Aviso do Fabricante
• http://mail-archives.apache.org/mod_mbox/portals-jetspeed-user/201603.mbox/%3CB9165E38-F3D8-496D-8642-8A53FCAC736A%40gmail.com%3E · Aviso do Fabricante