You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@juddi.apache.org by "Alex O'Ree (JIRA)" <ju...@ws.apache.org> on 2014/12/22 01:06:13 UTC

[jira] [Created] (JUDDI-903) SQL Injection on JUDDI API service, delete_publisher

Alex O'Ree created JUDDI-903:
--------------------------------

             Summary: SQL Injection on JUDDI API service, delete_publisher
                 Key: JUDDI-903
                 URL: https://issues.apache.org/jira/browse/JUDDI-903
             Project: jUDDI
          Issue Type: Bug
          Components: core
    Affects Versions: 3.2.1, 3.2
            Reporter: Alex O'Ree
            Assignee: Alex O'Ree
            Priority: Critical
             Fix For: 3.3


There's a potential for SQL injection in the Juddi API service. Due to the way the code is constructed, it's possible for a malicious user to be created containing a SQL statement as the user name. When an administrator attempts to delete the publisher, there's a chance that the malicious username may be executed as a SQL statement.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)