GitHub Advisoryadvisory · Maven

GHSA-88f6-79x2-xqf3 Apache Jetspeed vulnerable to SQL Injection

HIGH Published 2022-05-17 Modified 2025-04-14 Official page ↗
Aliases
CVE-2016-0710
Ecosystem
Maven
Packages
org.apache.portals.jetspeed-2:jetspeed
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2025-04-14

Affected packages

• Maven org.apache.portals.jetspeed-2:jetspeed: < 2.3.1 → fixed in 2.3.1

Description

Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the (1) role or (2) user parameter to services/usermanager/users/.

Related

Alias · CVE (1)

  • CVE-2016-0710 Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References