CVE-2016-2171

High

Published: 11/04/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The User Manager service in Apache Jetspeed before version 2.3.1 does not properly restrict access using Jetspeed Security, allowing remote attackers to add, edit, or delete users via the REST API.

Risk Assessment

The lack of proper access restrictions may lead to unauthorized changes to user accounts, jeopardizing the integrity of the system and organizational data.

Recommendation

It is recommended to update Apache Jetspeed to version 2.3.1 or later to fix this vulnerability and implement additional security measures for the API.

Other vulnerabilities in Apache Jetspeed

CVE-2016-0709High
Directory traversal vulnerability in the Import/Export function in Apache Jetspeed before version 2.3.1 allows remote authenticated administrators to write to arbitrary files, potentially executing arbitrary code.

Original NVD description (English source)

The User Manager service in Apache Jetspeed before 2.3.1 does not properly restrict access using Jetspeed Security, which allows remote attackers to (1) add, (2) edit, or (3) delete users via the REST API.