Unscored severity · published May 29, 2014
CVE-2014-3416
uPortal before 4.0.13.1 does not properly check the MANAGE permissions, which allows remote authenticated users to manage arbitrary portlets by leveraging the SUBSCRIBE permission…
–
CVSS
1.1%
EPSS
No
On KEV
Description
uPortal before 4.0.13.1 does not properly check the MANAGE permissions, which allows remote authenticated users to manage arbitrary portlets by leveraging the SUBSCRIBE permission for the portlet-admin portlet.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UP
Uportal · Jasig
through 4.0.13 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3416
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3416
Patch
http://www.jasig.org/uportal/download/uportal-4-0-13-1
issues.jasig.org
https://issues.jasig.org/browse/UP-4105
More from Uportal
–
CVE-2014-3417
uPortal before 4.0.13.1 does not properly check the CONFIG permission, which allows remote authenticated users to configure portlets by leveraging the SUBSCRIBE permission for a…