CVE-2016-2171 The User Manager service in Apache Jetspeed before 2.3.1 does not properly restrict access using Jetspeed Security, which allows remote attackers to (1) add, (2) edit, or (3) delete users via the REST...
HighCVSS 7.5
EPSS 42.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The User Manager service in Apache Jetspeed before 2.3.1 does not properly restrict access using Jetspeed Security, which allows remote attackers to (1) add, (2) edit, or (3) delete users via the REST API.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache jetspeed | <= 2.3.0 | No fix listed |
References
- haxx.ml
- [portals-jetspeed-user] 20160329 [CVE-2016-2171] Jetspeed User Manager REST service not restricted by Jetspeed Security mailing-list vendor-advisory
- portals.apache.org patch vendor-advisory