GHSA-49h4-g8p5-jgq6

Source

https://github.com/advisories/GHSA-49h4-g8p5-jgq6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-49h4-g8p5-jgq6/GHSA-49h4-g8p5-jgq6.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-49h4-g8p5-jgq6

Aliases

CVE-2015-5241

Published

2018-10-16T19:49:32Z

Modified

2023-11-08T03:57:56.884338Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Moderate severity vulnerability that affects org.apache.juddi:juddi-client

Details

After logging into the portal, the logout jsp page redirects the browser back to the login page after. It is feasible for malicious users to redirect the browser to an unintended web page in Apache jUDDI 3.1.2, 3.1.3, 3.1.4, and 3.1.5 when utilizing the portlets based user interface also known as 'Pluto', 'jUDDI Portal', 'UDDI Portal' or 'uddi-console'. User session data, credentials, and auth tokens are cleared before the redirect.

Database specific

{
    "nvd_published_at": null,
    "github_reviewed_at": "2020-06-16T20:57:58Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-601"
    ]
}

References

Affected packages

Maven / org.apache.juddi:juddi-client

Package

Name: org.apache.juddi:juddi-client; View open source insights on deps.dev
Purl: pkg:maven/org.apache.juddi/juddi-client

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.1.2

Fixed

3.2.0

Affected versions

3.*

3.1.2

3.1.3

3.1.4

3.1.5

Database specific

{
    "last_known_affected_version_range": "<= 3.1.5"
}