uPortal before 4.0.13.1 does not properly check the MANAGE permissions, which allows remote authenticated users to manage arbitrary portlets by leveraging the SUBSCRIBE permission for the portlet-admin portlet.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2014-05-29T14:00:00
Updated: 2024-08-06T10:43:05.512Z
Reserved: 2014-05-07T00:00:00
Link: CVE-2014-3416
Vulnrichment
No data.
NVD
Status : Analyzed
Published: 2014-05-29T14:19:08.300
Modified: 2014-05-30T16:35:34.240
Link: CVE-2014-3416
Redhat
No data.