CVE-2014-3416

uPortal before 4.0.13.1 does not properly check the MANAGE permissions, which allows remote authenticated users to manage arbitrary portlets by leveraging the SUBSCRIBE permission for the portlet-admin portlet.

Score

CVSS 2.0 6.5 Medium

Status

Modified - cve@mitre.org

Published

2014-05-29

Last modified

2024-08-06

Weaknesses

CWE-264

Affected products

• Uportal (Jasig)

References

• http://www.jasig.org/uportal/download/uportal-4-0-13-1
• https://issues.jasig.org/browse/UP-4105