CVE-2014-3416

uPortal before 4.0.13.1 does not properly check the MANAGE permissions, which allows remote authenticated users to manage arbitrary portlets by leveraging the SUBSCRIBE permission for the portlet-admin portlet.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:S/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 60%
Affected Products (NVD)
VendorProductVersion
jasiguportal
𝑥
≤ 4.0.13
𝑥
= Vulnerable software versions
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
php54
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-bcmath
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-cli
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-common
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-dba
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-debuginfo
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-devel
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-embedded
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-enchant
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-fpm
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-gd
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-imap
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-intl
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-ldap
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-mbstring
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-mcrypt
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-mssql
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-mysql
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-mysqlnd
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-odbc
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-pdo
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-pgsql
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-process
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-pspell
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-recode
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-snmp
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-soap
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-tidy
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-xml
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-xmlrpc
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php55
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-bcmath
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-cli
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-common
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-dba
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-debuginfo
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-devel
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-embedded
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-enchant
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-fpm
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-gd
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-gmp
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-imap
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-intl
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-ldap
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-mbstring
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-mcrypt
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-mssql
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-mysqlnd
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-odbc
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-opcache
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-pdo
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-pgsql
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-process
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-pspell
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-recode
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-snmp
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-soap
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-tidy
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-xml
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-xmlrpc
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php56
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-bcmath
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-cli
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-common
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-dba
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-dbg
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-debuginfo
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-devel
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-embedded
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-enchant
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-fpm
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-gd
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-gmp
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-imap
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-intl
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-ldap
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-mbstring
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-mcrypt
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-mssql
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-mysqlnd
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-odbc
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-opcache
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-pdo
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-pgsql
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-process
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-pspell
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-recode
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-snmp
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-soap
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-tidy
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-xml
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-xmlrpc
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
Common Weakness Enumeration
References
http://www.jasig.org/uportal/download/uportal-4-0-13-1
https://issues.jasig.org/browse/UP-4105
http://www.jasig.org/uportal/download/uportal-4-0-13-1
https://issues.jasig.org/browse/UP-4105