[CVE-2016-2171] Jetspeed User Manager REST service not restricted by Jetspeed Security

CVE-2016-2171: Jetspeed User Manager REST service not restricted by =
Jetspeed Security

Severity: Important

Vendor:
The Apache Software Foundation

Versions Affected:
Jetspeed 2.3.0

Description:
The Jetspeed User Manager services are vulnerable to unauthorized =
access. The following APIs are not restricted by Jetspeed Security:

GET http://host/jetspeed/services/usermanager/users/
GET http://host/jetspeed/services/usermanager/users/{name}/
POST http://host/jetspeed/services/usermanager/users/{name}/
POST http://host/jetspeed/services/usermanager/users/
DELETE http://host/jetspeed/services/usermanager/users/{name}/

In the upcoming 2.3.1 release, these URLs are properly secured by =
Jetspeed Security, requiring Administrative rights.

Mitigation:
2.3.0 users should upgrade to 2.3.1

Credit:
This issue was discovered by =EF=BB=BFAndreas Lindh

References:
http://tomcat.apache.org/security.html=