PT-2017-6835 · Apache · Apache Juddi

Publicado 2017-05-19 · Atualizado 2018-10-16 · CVE-2015-5241

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache jUDDI versions 3.1.2 through 3.1.5

Description The issue allows malicious users to redirect the browser to an unintended web page after logging out, potentially leading to unauthorized access or information disclosure. This occurs when using the portlets-based user interface in Apache jUDDI. User session data, credentials, and authentication tokens are cleared before the redirect.

Recommendations For Apache jUDDI versions 3.1.2 through 3.1.5, consider restricting access to the logout jsp page to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the portlets-based user interface, also known as 'Pluto', 'jUDDI Portal', 'UDDI Portal', or 'uddi-console', to prevent potential redirects to unintended web pages.

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2015-5241

GHSA-49H4-G8P5-JGQ6

Produtos afetados

Apache Juddi

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2015-5241 · Nota de Segurança
• http://juddi.apache.org/security.html · Aviso do Fabricante
• https://github.com/advisories/GHSA-49h4-g8p5-jgq6 · Nota
• https://osv.dev/vulnerability/GHSA-49h4-g8p5-jgq6 · Aviso do Fabricante