PT-2013-2226 · Red Hat · Jboss Enterprise Portal Platform

Nick Scavelli · Published 2013-04-12 · Updated 2013-04-15 · CVE-2013-0314

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions JBoss Enterprise Portal Platform version 5.2.2

Description The issue concerns the GateIn Portal export/import gadget, which fails to properly check authentication when importing Zip files. This allows remote attackers to modify site contents, remove the site, or alter the access controls for portlets.

Recommendations For JBoss Enterprise Portal Platform version 5.2.2, consider restricting access to the import functionality of the GateIn Portal export/import gadget until a proper fix is available, to minimize the risk of unauthorized modifications to site contents or access controls.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2013-0314

Affected Products

Jboss Enterprise Portal Platform

References · 5

• http://secunia.com/advisories/52552 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-0314 · Security Note
• http://rhn.redhat.com/errata/RHSA-2013-0613.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=913327 · Note
• http://osvdb.org/91120 · Note