CVE-2014-3417

uPortal before 4.0.13.1 does not properly check the CONFIG permission, which allows remote authenticated users to configure portlets by leveraging the SUBSCRIBE permission for a portlet...

PT-2014-5305

Name of the Vulnerable Software and Affected Versions uPortal versions prior to 4.0.13.1 Description The issue arises from improper checking of the CONFIG permission, allowing remote authenticated users to configure portlets by leveraging the SUBSCRIBE permission for a portlet. Recommendations Fo...