Lucene search
HistoryMay 29, 2014 - 2:19 p.m.
CVE-2014-3417
cve-2014-3417
uportal
security vulnerability
config permission
portlet configuration
nvd
6.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
6.4 Medium
AI Score
Confidence
Low
0.002 Low
EPSS
Percentile
60.1%
uPortal before 4.0.13.1 does not properly check the CONFIG permission, which allows remote authenticated users to configure portlets by leveraging the SUBSCRIBE permission for a portlet.
Affected configurations
Node
jasiguportalRange≤4.0.13
| CPE | Name | Operator | Version |
|---|---|---|---|
| jasig:uportal | jasig uportal | le | 4.0.13 |
Related
cvelist
cvelist
CVE-2014-3417
2014-05-29 14:00:00
prion
prion
Code injection
2014-05-29 14:19:00
nvd
nvd
CVE-2014-3417
2014-05-29 14:19:08
6.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
6.4 Medium
AI Score
Confidence
Low
0.002 Low
EPSS
Percentile
60.1%
Related for CVE-2014-3417