You are viewing a plain text version of this content. The canonical link for it is here.

Posted to user@juddi.apache.org by Kurt Stam <ku...@gmail.com> on 2018/02/09 01:51:26 UTC

[Announce] CVE-2009-4267 - vulnerability in jUDDI 3.0.0 console.

[CVEID] : CVE-2009-4267
[PRODUCT] : Apache jUDDI information disclosure vulnerability
[VERSION]:  3.0.0
[PROBLEMTYPE] : Information Disclosure
[DISCRIPTION]: The jUDDI console doesn't escape line feeds that were passed in the numRows parameter. This affects log integrity, as this allows authenticated users to forge log records.

Severity: Moderate

Vendor:
The Apache Software Foundation

Mitigation:
3.0.0 users should upgrade to jUDDI 3.0.1 or newer

Credit:
This issue was discovered by Marc Schoenefeld of Red Hat Software.

Thanks,

—Kurt

Kurt T Stam