apache jetspeed vulnerabilities

Latest apache jetspeed CVEs

Newest publication first

1. CVE-2022-32533 Apache Portals Jetspeed XSS, CSRF, SSRF, and XXE issues

   Published 2022-07-06

   Critical·CVSS 9.8 EPSS 4.2%

   Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the configuration option "xss.filter.post = true" may mitigate these issues. NOTE: Apache Jetspeed is a dormant project of Apac...

2. CVE-2016-2171 The User Manager service in Apache Jetspeed before 2.3.1 does not properly restrict access using Jetspeed Security, which allows remote attackers to (1) add, (2) edit, or (3) delete users via the REST...

   Published 2016-04-11

   High·CVSS 7.5

   The User Manager service in Apache Jetspeed before 2.3.1 does not properly restrict access using Jetspeed Security, which allows remote attackers to (1) add, (2) edit, or (3) delete users via the REST API.

3. CVE-2016-0712 Cross-site Scripting in Apache Jetspeed

   Published 2016-04-11

   Medium·CVSS 6.1

   Cross-site scripting (XSS) vulnerability in Apache Jetspeed before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to portal.

4. CVE-2016-0711 Apache Jetspeed vulnerable to Cross-site Scripting

   Published 2016-04-11

   Medium·CVSS 6.1

   Multiple cross-site scripting (XSS) vulnerabilities in Apache Jetspeed before 2.3.1 allow remote attackers to inject arbitrary web script or HTML via the title parameter when adding a (1) link, (2) page, or (3) folder resource.

5. CVE-2016-0710 Apache Jetspeed vulnerable to SQL Injection

   Published 2016-04-11

   High·CVSS 8.8 EPSS 52.4% Framework module Public exploit

   Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the (1) role or (2) user parameter to services/usermanager/users/.

6. CVE-2016-0709 Path Traversal in Apache Jetspeed

   Published 2016-04-11

   High·CVSS 7.2 EPSS 77.5% Framework module Public exploit

   Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files, and consequently execute arbitrary code, via a .. (dot dot) in a ZIP archive entry, a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.