← volver
CVE-2016-0710

CVE-2016-0710

EPSS 52.4%
Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the (1) role or (2) user parameter to services/usermanager/users/.
Productos afectados
n/a · n/a
PoCs públicas encontradas — 3
cve_referencepacketstormsecurity.com/files/136489/Apache-Jetspeed-Arbitrary-File-Upload.htmlno verificadocve_referencewww.exploit-db.com/exploits/39643/no verificadoexploitdbwww.exploit-db.com/exploits/39643no verificado
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →
Referencias
http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-andhttp://packetstormsecurity.com/files/136489/Apache-Jetspeed-Arbitrary-File-Upload.htmlhttps://mail-archives.apache.org/mod_mbox/portals-jetspeed-user/201603.mbox/%3C046318A1-226E-453F-9394-B84F1A33E6A4%40bluesunrise.com%3Ehttps://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-0710https://www.exploit-db.com/exploits/39643/http://www.rapid7.com/db/modules/exploit/multi/http/apache_jetspeed_file_upload