PT-2016-5046 · Apache · Apache Jetspeed

Andreas Lindh · Published 2016-04-11 · Updated 2016-04-14 · CVE-2016-2171

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Jetspeed versions prior to 2.3.1

Description The issue concerns the User Manager service in Apache Jetspeed, which fails to properly restrict access using Jetspeed Security. This allows remote attackers to perform unauthorized actions on users via the REST API, including adding, editing, or deleting users.

Recommendations For versions prior to 2.3.1, update to version 2.3.1 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2016-2171

Affected Products

Apache Jetspeed

References · 5

• https://osv.dev/vulnerability/CVE-2016-2171 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-2171 · Security Note
• https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-2171 · Vendor Advisory
• http://mail-archives.apache.org/mod_mbox/portals-jetspeed-user/201603.mbox/%3CB9165E38-F3D8-496D-8642-8A53FCAC736A%40gmail.com%3E · Vendor Advisory
• http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-and · Note