CVE-2016-0710 Apache Jetspeed vulnerable to SQL Injection

What is CVE-2016-0710?

CVE-2016-0710 is a high-severity SQL injection vulnerability in n/a, published on 11 Apr 2016. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the (1) role or (2) user parameter to services/usermanager/users/.

Weakness: CWE-89

Which versions are affected by CVE-2016-0710?

2 open source packages ship an affected version, including org.apache.portals.jetspeed-2:jetspeed. It affects 1 product.

Products include Apache Jetspeed.

How do I fix CVE-2016-0710?

Upgrade org.apache.portals.jetspeed-2:jetspeed to 2.3.1 or later.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2016-0710 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2016-0710 exists.

Public exploit code: 1 Metasploit module and 1 Exploit-DB entry.

Other vulnerabilities in n/a

• CVE-2022-32533 Apache Portals Jetspeed XSS, CSRF, SSRF, and XXE issues Critical 9.8
• CVE-2016-2171 Missing authorization in n/a High 7.5
• CVE-2016-0709 Path Traversal in Apache Jetspeed High 7.2
• CVE-2016-0711 Apache Jetspeed vulnerable to Cross-site Scripting Medium 6.1
• CVE-2016-0712 Cross-site Scripting in Apache Jetspeed Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-88f6-79x2-xqf3.