CVEvulnerability
CVE-2016-2171
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2016-04-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 6.4 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:P
- Weaknesses
- CWE-264
Description
The User Manager service in Apache Jetspeed before 2.3.1 does not properly restrict access using Jetspeed Security, which allows remote attackers to (1) add, (2) edit, or (3) delete users via the REST API.
Affected configurations
• apache jetspeed (<= 2.3.0)
Related
Weakness · not in database (1)
References
- http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-and haxx.ml
- http://mail-archives.apache.org/mod_mbox/portals-jetspeed-user/201603.mbox/%3CB9165E38-F3D8-496D-8642-8A53FCAC736A%40gmail.com%3E Vendor Advisory
- https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-2171 Patch, Vendor Advisory
- http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-and haxx.ml
- http://mail-archives.apache.org/mod_mbox/portals-jetspeed-user/201603.mbox/%3CB9165E38-F3D8-496D-8642-8A53FCAC736A%40gmail.com%3E Vendor Advisory
- https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-2171 Patch, Vendor Advisory