CVE-2013-0314 - Portal: remote unauthenticated site import

Back Back to CVE browser

HIGH

Portal: remote unauthenticated site import

Published Apr 12, 2013

7.5

HIGH

CVSS 2.0

EPSS 1.64%

Description

The GateIn Portal export/import gadget in JBoss Enterprise Portal Platform 5.2.2 does not properly check authentication when importing Zip files, which allows remote attackers to modify site contents, remove the site, or alter the access controls for portlets.

Affected products

Red Hat JBoss Portal 5.2

n/a

Fixed · RHSA-2013:0613
Red Hat JBoss Portal 5

portal

Affected

Product	Package	State	Advisory
Red Hat JBoss Portal 5.2	n/a	Fixed	RHSA-2013:0613
Red Hat JBoss Portal 5	portal	Affected	n/a

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-287

Improper Authentication

CWE-306

Missing Authentication

References (7)

http://rhn.redhat.com/errata/RHSA-2013-0613.html
vendor-advisoryx_refsource_REDHATVendor Advisory
http://secunia.com/advisories/52552
third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.osvdb.org/91120
vdb-entryx_refsource_OSVDB
https://access.redhat.com/security/cve/CVE-2013-0314
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=913327
x_refsource_MISCIssue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2013-0314
https://www.cve.org/CVERecord?id=CVE-2013-0314

Link	Providers	Tags
http://rhn.redhat.com/errata/RHSA-2013-0613.html		vendor-advisoryx_refsource_REDHATVendor Advisory
http://secunia.com/advisories/52552		third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.osvdb.org/91120		vdb-entryx_refsource_OSVDB
https://access.redhat.com/security/cve/CVE-2013-0314		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=913327		x_refsource_MISCIssue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2013-0314
https://www.cve.org/CVERecord?id=CVE-2013-0314