Apache Jetspeed vulnerable to SQL Injection

HIGH 8.8CVE-2016-0710 · GHSA-88f6-79x2-xqf3 · Published 11/04/2016 · updated 17/06/2026

Package	Affected versions	Patched versions
org.apache.portals.jetspeed-2:jetspeed Maven	`< 2.3.1`	`2.3.1`
jetspeed apache	`≤ 2.3.0`	No fix yet

Description

Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the (1) role or (2) user parameter to services/usermanager/users/.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2016-0710 · ADVISORY
mail-archives.apache.org/mod_mbox/portals-jetspeed-user/201603.mbox/%3C046318A1-226E-453F-9394-B84F1A33E6A4%40bluesunrise.com%3E · WEB
mail-archives.apache.org/mod_mbox/portals-jetspeed-user/201603.mbox/%[email protected]%3E · WEB
portals.apache.org/jetspeed-2/security-reports.html · WEB
exploit-db.com/exploits/39643 · WEB
haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-and · WEB
packetstormsecurity.com/files/136489/Apache-Jetspeed-Arbitrary-File-Upload.html · WEB
rapid7.com/db/modules/exploit/multi/http/apache_jetspeed_file_upload · WEB
exploit-db.com/exploits/39643 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free