CVE-2016-0710 Apache Jetspeed vulnerable to SQL Injection
HighCVSS 8.8
EPSS 52.4%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the (1) role or (2) user parameter to services/usermanager/users/.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.portals.jetspeed-2/jetspeed(Maven) | < 2.3.1 | 2.3.1 |
| org.apache.portals.jetspeed-2/jetspeed(Maven) | = 2.0 | No fix listed |
| org.apache.portals.jetspeed-2/jetspeed(Maven) | = 2.1.3 | No fix listed |
| org.apache.portals.jetspeed-2/jetspeed(Maven) | = 2.1.4 | No fix listed |
| org.apache.portals.jetspeed-2/jetspeed(Maven) | = 2.2.0 | No fix listed |
| org.apache.portals.jetspeed-2/jetspeed(Maven) | = 2.2.1 | No fix listed |
| org.apache.portals.jetspeed-2/jetspeed(Maven) | = 2.2.2 | No fix listed |
| org.apache.portals.jetspeed-2/jetspeed(Maven) | = 2.3.0 | No fix listed |
| apache jetspeed | <= 2.3.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- [portals-jetspeed-user] 20160303 [CVE-2016-0710] Apache Jetspeed information disclosure vulnerability mailing-list
- mail-archives.apache.org
- portals.apache.org vendor-advisory
- 39643 exploit
- haxx.ml exploit
- packetstormsecurity.com exploit
- www.rapid7.com exploit
- github.com