[CVE-2016-0710] Apache Jetspeed information disclosure vulnerability

--Apple-Mail=_388E37E2-7216-4D08-A1A7-166800E20903
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

CVE-2016-0710: SQL injection in User Manager service

Severity: Important

Vendor:
The Apache Software Foundation

Versions Affected:
Jetspeed 2.3.0

Description:
The Jetspeed User Manager service, part of the Jetspeed Administrative =
Portlets, is vulnerable to SQL injection. When performing a search in =
these tools, the 'user' and 'role' parameters of the request can be =
injected to alter the logic of the subsequent SQL statement.=20
There is also an authorization flaw at play here since the above URLs =
can be reached without being authenticated in Jetspeed.

Mitigation:
2.3.0 users should upgrade to 2.3.1

Example:
Given this URL:
=
http://192.168.2.4:8080/jetspeed/services/usermanager/users/?_type=3Djson&=
results=3D10&start=3D0&sort=3DuserName&dir=3Dasc&name=3D&roles=3Dfoo%27%20=
=20
The 'role' parameter contains the value "foo" which is not an existing =
role, but because of the injected SQL code (or '1'=3D'1') the statement =
returns true anyway and all the existing users are shown.

Credit:
This issue was discovered by =EF=BB=BFAndreas Lindh

References:
http://tomcat.apache.org/security.html =
<http://tomcat.apache.org/security.html>






--Apple-Mail=_388E37E2-7216-4D08-A1A7-166800E20903--