VulnerabilityModified

CVE-2016-0710

Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the (1) role or (2) user parameter to services/usermanager/users/.

HIGH 8.8EPSS 52.4%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 52.4%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.

Description

CVSS 3.0: 8.8 HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 52.35% probability · 99th percentile
CISA KEV: Not listed
Weakness: CWE-89
Affected: apache/jetspeed
Source: secalert@redhat.com

References

http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-andExploit
http://packetstormsecurity.com/files/136489/Apache-Jetspeed-Arbitrary-File-Upload.htmlExploit
http://www.rapid7.com/db/modules/exploit/multi/http/apache_jetspeed_file_upload
https://mail-archives.apache.org/mod_mbox/portals-jetspeed-user/201603.mbox/%3C046318A1-226E-453F-9394-B84F1A33E6A4%40bluesunrise.com%3E
https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-0710Vendor Advisory
https://www.exploit-db.com/exploits/39643/Exploit
http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-andExploit
http://packetstormsecurity.com/files/136489/Apache-Jetspeed-Arbitrary-File-Upload.htmlExploit
http://www.rapid7.com/db/modules/exploit/multi/http/apache_jetspeed_file_upload
https://mail-archives.apache.org/mod_mbox/portals-jetspeed-user/201603.mbox/%3C046318A1-226E-453F-9394-B84F1A33E6A4%40bluesunrise.com%3E
https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-0710Vendor Advisory
https://www.exploit-db.com/exploits/39643/Exploit

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.