Apache Jetspeed access restriction Security Vulnerability (CVE-2016-2171)

Apache Jetspeed access restriction Security Vulnerability (CVE-2016-2171)
Apache Jetspeed access restriction Security Vulnerability (CVE-2016-2171)

Release date:
Updated on:

Affected Systems:

Apache Group Jetspeed <2.3.1

Description:

CVE (CAN) ID: CVE-2016-2171

Jetspeed is an open portal platform and enterprise information portal.

In versions earlier than Jetspeed 2.3.1, Jetspeed Security does not properly restrict access to the User Manager Service. Remote attackers can add, edit, and delete users through the rest api.

<* Source: Apache
*>

Suggestion:

Vendor patch:

Apache Group
------------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-2171

This article permanently updates the link address: