Unscored CVE-2014-3416 EUVD-2014-3429GHSA-9gm3-h5cr-p7p2

uPortal before 4.0.13.1 does not properly check the MANAGE permissions, which allows remote authenticated users to manage arbitrary portlet…

Published May 29, 2014 · Updated Aug 6, 2024 · Assigned by mitre

Description

uPortal before 4.0.13.1 does not properly check the MANAGE permissions, which allows remote authenticated users to manage arbitrary portlets by leveraging the SUBSCRIBE permission for the portlet-admin portlet.

References

http://www.jasig.org/uportal/download/uportal-4-0-13-1
https://issues.jasig.org/browse/UP-4105