Mailing-List: contact jetspeed-user-help@portals.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Jetspeed Users List" <jetspeed-user@portals.apache.org>
From: David S Taylor <david@bluesunrise.com>
Content-Type: multipart/alternative;
 boundary="Apple-Mail=_388E37E2-7216-4D08-A1A7-166800E20903"
Subject: [CVE-2016-0710] Apache Jetspeed information disclosure vulnerability
Message-Id: <046318A1-226E-453F-9394-B84F1A33E6A4@bluesunrise.com>
Date: Thu, 3 Mar 2016 13:16:30 -0800
To: Jetspeed Users List <jetspeed-user@portals.apache.org>
Mime-Version: 1.0 (Mac OS X Mail 9.2 \(3112\))

--Apple-Mail=_388E37E2-7216-4D08-A1A7-166800E20903
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

CVE-2016-0710: SQL injection in User Manager service

Severity: Important

Vendor:
The Apache Software Foundation

Versions Affected:
Jetspeed 2.3.0

Description:
The Jetspeed User Manager service, part of the Jetspeed Administrative =
Portlets, is vulnerable to SQL injection. When performing a search in =
these tools, the 'user' and 'role' parameters of the request can be =
injected to alter the logic of the subsequent SQL statement.=20
There is also an authorization flaw at play here since the above URLs =
can be reached without being authenticated in Jetspeed.

Mitigation:
2.3.0 users should upgrade to 2.3.1

Example:
Given this URL:
=
http://192.168.2.4:8080/jetspeed/services/usermanager/users/?_type=3Djson&=
results=3D10&start=3D0&sort=3DuserName&dir=3Dasc&name=3D&roles=3Dfoo%27%20=
=20
The 'role' parameter contains the value "foo" which is not an existing =
role, but because of the injected SQL code (or '1'=3D'1') the statement =
returns true anyway and all the existing users are shown.

Credit:
This issue was discovered by =EF=BB=BFAndreas Lindh

References:
http://tomcat.apache.org/security.html =
<http://tomcat.apache.org/security.html>


--Apple-Mail=_388E37E2-7216-4D08-A1A7-166800E20903--