CVEvulnerability
CVE-2016-0710
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2016-04-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the (1) role or (2) user parameter to services/usermanager/users/.
Affected configurations
• apache jetspeed (<= 2.3.0)
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-and Exploit
- http://packetstormsecurity.com/files/136489/Apache-Jetspeed-Arbitrary-File-Upload.html Exploit
- http://www.rapid7.com/db/modules/exploit/multi/http/apache_jetspeed_file_upload www.rapid7.com
- https://mail-archives.apache.org/mod_mbox/portals-jetspeed-user/201603.mbox/%3C046318A1-226E-453F-9394-B84F1A33E6A4%40bluesunrise.com%3E mail-archives.apache.org
- https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-0710 Vendor Advisory
- https://www.exploit-db.com/exploits/39643/ Exploit
- http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-and Exploit
- http://packetstormsecurity.com/files/136489/Apache-Jetspeed-Arbitrary-File-Upload.html Exploit
- http://www.rapid7.com/db/modules/exploit/multi/http/apache_jetspeed_file_upload www.rapid7.com
- https://mail-archives.apache.org/mod_mbox/portals-jetspeed-user/201603.mbox/%3C046318A1-226E-453F-9394-B84F1A33E6A4%40bluesunrise.com%3E mail-archives.apache.org
- https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-0710 Vendor Advisory
- https://www.exploit-db.com/exploits/39643/ Exploit