CVE-2016-2171

Published: Apr 11, 2016Modified: May 6, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The User Manager service in Apache Jetspeed before 2.3.1 does not properly restrict access using Jetspeed Security, which allows remote attackers to (1) add, (2) edit, or (3) delete users via the REST API.

Affected (1)

Products: Apache: Jetspeed

Apache

1 product

Jetspeed

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Jetspeed	Up to 2.3.0

Related CWEs

CWE-264

References (6)

http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-and

Source: secalert@redhat.com

http://mail-archives.apache.org/mod_mbox/portals-jetspeed-user/201603.mbox/%3CB9165E38-F3D8-496D-8642-8A53FCAC736A%40gmail.com%3E

Source: secalert@redhat.com

Vendor Advisory

https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-2171

Source: secalert@redhat.com

PatchVendor Advisory

http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-and

Source: af854a3a-2127-422b-91ae-364da2661108

http://mail-archives.apache.org/mod_mbox/portals-jetspeed-user/201603.mbox/%3CB9165E38-F3D8-496D-8642-8A53FCAC736A%40gmail.com%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-2171

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.