CVE-2014-3416 | BDVDB-2026-61860 Detail

Description#

uPortal before 4.0.13.1 does not properly check the MANAGE permissions, which allows remote authenticated users to manage arbitrary portlets by leveraging the SUBSCRIBE permission for the portlet-admin portlet.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://www.jasig.org/uportal/download/uportal-4-0-13-1
https://issues.jasig.org/browse/UP-4105

Exploit#

No public exploit known

History#

Version 12014-05-29Record published in the CVE List.
Version 22024-08-06Most recent update recorded in the CVE List.