CVE-2016-0709
high
CVSS v3
7.2
CVSS v4 NEW
—
VIR risk
8.2
Description
Path Traversal in Apache Jetspeed
Predictions
Exploit likelihood
81%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Exploits
Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.
Metasploit modules
Source code queued for fetch — refresh in a moment.
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| Maven | org.apache.portals.jetspeed-2:jetspeed | <2.3.1 | 2.3.1 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| apache | jetspeed | {"endIncluding":"2.3.0"} | |
References
- http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-and
- http://packetstormsecurity.com/files/136489/Apache-Jetspeed-Arbitrary-File-Upload.html
- http://www.rapid7.com/db/modules/exploit/multi/http/apache_jetspeed_file_upload
- https://mail-archives.apache.org/mod_mbox/portals-jetspeed-user/201603.mbox/%3C281D02D0-6A03-4421-9D86-E73B001C8677%40bluesunrise.com%3E
- https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-0709
- https://www.exploit-db.com/exploits/39643/
- https://nvd.nist.gov/vuln/detail/CVE-2016-0709
- https://mail-archives.apache.org/mod_mbox/portals-jetspeed-user/201603.mbox/%3C281D02D0-6A03-4421-9D86-E73B001C8677@bluesunrise.com%3E
- https://www.exploit-db.com/exploits/39643
CWEs
CWE-22
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.