NVD

Id
18443  
Name
CVE-2016-2171  
Description
The User Manager service in Apache Jetspeed before 2.3.1 does not properly restrict access using Jetspeed Security, which allows remote attackers to (1) add, (2) edit, or (3) delete users via the REST API.  
Reject
 
CVSS Version
2  
CVSS Score
6.4  
Severity
Medium  
CVSS Base Score
6.4  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:P/A:P)  
Pub Date
2017-01-19  
Published
2016-04-11  
Modified Date
2016-04-14  
Seq
2016-2171  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
102460 18443 CVE-2016-2171 http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-and  View
102461 18443 CVE-2016-2171 [portals-jetspeed-user] 20160329 [CVE-2016-2171] Jetspeed User Manager REST service not restricted by Jetspeed Security  View
102462 18443 CVE-2016-2171 https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-2171  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
1308 JVNDB-2016-002081 Apache Jetspeed の User Manager サービスにおけるユーザを追加される脆弱性 Apache Jetspeed の User Manager サービスは、Jetspeed Security を使用するアクセスを適切に制限しないため、ユーザを (1) 追加、(2) 編集、または (3) 削除される脆弱性が存在します。 CVE-2016-2171 88677 CVE-2016-2171 18443 6.4 7.5 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-002081.html 2016-03-28 2016-04-18 View