Code injection

2014-05-2914:19:00

PRIOn knowledge base

www.prio-n.com

6.8 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

60.0%

JSON

uPortal before 4.0.13.1 does not properly check the CONFIG permission, which allows remote authenticated users to configure portlets by leveraging the SUBSCRIBE permission for a portlet.

CPENameOperatorVersion
uportalle4.0.13

CPE	Name	Operator	Version
	uportal	le	4.0.13

References

www.jasig.org/uportal/download/uportal-4-0-13-1

issues.jasig.org/browse/UP-4106