CVE-2016-2171

Published: Apr 11, 2016

Modified: Aug 5, 2024

PUBLISHED

Description

The User Manager service in Apache Jetspeed before 2.3.1 does not properly restrict access using Jetspeed Security, which allows remote attackers to (1) add, (2) edit, or (3) delete users via the REST API.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-2171

x_refsource_CONFIRM

[portals-jetspeed-user] 20160329 [CVE-2016-2171] Jetspeed User Manager REST service not restricted by Jetspeed Security

mailing-list

x_refsource_MLIST

http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-and

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2016-2171

Description

Affected Products

References