← Vulnerability feed

Vulnerability record · CVE-2016-2171 · published 11 April 2016

CVE-2016-2171: Apache jetspeed permissions and access controls vulnerability

Apache · Jetspeed

The User Manager service in Apache Jetspeed before 2.3.1 does not properly restrict access using Jetspeed Security, which allows remote attackers to (1) add, (2) edit, or (3) delete users via the REST API.

7.5 CVSS 3.0 High EPSS 43% · top 1.3% CWE-264 · Permissions and access controls
7.5CVSS 3.0 base score, v2 6.4
43%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

The User Manager service in Apache Jetspeed before 2.3.1 does not properly restrict access using Jetspeed Security, which allows remote attackers to (1) add, (2) edit, or (3) delete users via the REST API.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-and
http://mail-archives.apache.org/mod_mbox/portals-jetspeed-user/201603.mbox/%3CB9165E38-F3D8-496D-8642-8A53FCAC736A%40gma Vendor Advisory
https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-2171 PatchVendor Advisory
http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-and
http://mail-archives.apache.org/mod_mbox/portals-jetspeed-user/201603.mbox/%3CB9165E38-F3D8-496D-8642-8A53FCAC736A%40gma Vendor Advisory
https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-2171 PatchVendor Advisory

Track CVE-2016-2171 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-32533Apache jetspeed cross-site scripting vulnerabilityApache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Sett…EPSS 4.1%8.8CVE-2016-0710Apache Jetspeed User Manager SQL injectionApache Jetspeed before 2.3.1 contains multiple SQL injection flaws in the User Manager service, reachable through the role and user parameters of ser…EPSS 52%analysed7.2CVE-2016-0709Apache Jetspeed Portal Site Manager path traversal enables code executionThe Import/Export function in Apache Jetspeed's Portal Site Manager fails to sanitize ZIP archive entry names, allowing directory traversal via '..' …EPSS 77%analysed6.1CVE-2016-0712Apache jetspeed cross-site scripting vulnerabilityCross-site scripting (XSS) vulnerability in Apache Jetspeed before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via the PATH_…EPSS 3.2%6.1CVE-2016-0711Apache jetspeed cross-site scripting vulnerabilityMultiple cross-site scripting (XSS) vulnerabilities in Apache Jetspeed before 2.3.1 allow remote attackers to inject arbitrary web script or HTML via…EPSS 3.1%5.1CVE-2015-3246libuser userhelper direct /etc/passwd write race conditionlibuser before 0.56.13-8 and 0.60 before 0.60-7, as used by the userhelper program in the usermode package, modifies /etc/passwd directly instead of …KEVEPSS 8.8%analysed6.6CVE-2015-1769Windows Mount Manager symlink mishandling allows local privilege escalationThe Windows Mount Manager mishandles symbolic links, allowing a crafted USB device to trigger arbitrary code execution. Because the flaw is in a core…KEVEPSS 4.1%analysed7.8CVE-2016-3643SolarWinds Virtualization Manager sudo misconfiguration privilege escalationSolarWinds Virtualization Manager 6.3.1 and earlier ship with a misconfigured sudo policy that lets a local user run privileged commands, as shown by…KEVEPSS 3.7%analysed

Source: NIST National Vulnerability Database (record CVE-2016-2171), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.