You are viewing a plain text version of this content. The canonical link for it is here.

Posted to user@roller.apache.org by Dave <sn...@gmail.com> on 2013/10/30 22:24:10 UTC

CVE-2013-4212 Apache Roller contains remote code execution vulnerabilities

Severity: important

Vendor: The Apache Software Foundation

Versions Affected:
Roller 4.0.0 to Roller 4.0.1
Roller 5.0 and Roller 5.0.1
The unsupported Roller 3.1 release is also affected

Description:
Some parts of Roller's editor and administration console were vulnerable to
pre-authenticated remote code execution issues.

Mitigation
Roller 4.0 and 4.0.1 users should upgrade to Roller 5.0.2
Roller 5.0 and 5.0.1 users should upgrade to Roller 5.0.2
Roller 3.1 users should upgrade to Roller 5.0.2

Credit:
Coverity SRL (Security Research Laboratory)