Description
The User Manager service in Apache Jetspeed before 2.3.1 does not properly restrict access using Jetspeed Security, which allows remote attackers to (1) add, (2) edit, or (3) delete users via the REST API.
Remediation
References
http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-and
http://mail-archives.apache.org/mod_mbox/portals-jetspeed-user/201603.mbox/%3CB9165E38-F3D8-496D-8642-8A53FCAC736A%40gmail.com%3E
https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-2171
Related Vulnerabilities
CVE-2012-0818 Vulnerability in maven package org.jboss.resteasy:resteasy-jaxb-provider
CVE-2016-6659 Vulnerability in maven package org.cloudfoundry.identity:cloudfoundry-identity-uaa
CVE-2023-33008 Vulnerability in maven package org.apache.johnzon:johnzon
CVE-2023-23623 Vulnerability in npm package electron
CVE-2020-26882 Vulnerability in maven package com.typesafe.play:play-java