Description
The User Manager service in Apache Jetspeed before 2.3.1 does not properly restrict access using Jetspeed Security, which allows remote attackers to (1) add, (2) edit, or (3) delete users via the REST API.
Remediation
References
http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-and
http://mail-archives.apache.org/mod_mbox/portals-jetspeed-user/201603.mbox/%3CB9165E38-F3D8-496D-8642-8A53FCAC736A%40gmail.com%3E
https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-2171
Related Vulnerabilities
CVE-2014-3665 Vulnerability in maven package org.jenkins-ci.main:jenkins-core
CVE-2008-5515 Vulnerability in maven package tomcat:catalina
CVE-2020-2248 Vulnerability in maven package org.jenkins-ci.plugins:jsgames
CVE-2017-12629 Vulnerability in maven package org.apache.lucene:lucene-queryparser
CVE-2013-6397 Vulnerability in maven package org.apache.solr:solr-velocity