CVE-2015-5241: Apache jUDDI juddi-client Logout Page Redirection Vulnerability
Summary
CVE-2015-5241: Moderate severity vulnerability that affects org.apache.juddi:juddi-client. Affects org.apache.juddi:juddi-client versions >= 3.1.2, < 3.2.0. Fixed in 3.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache jUDDI is an open-source Java implementation of the Universal Description, Discovery, and Integration (UDDI) specification. It provides a platform for publishing, discovering, and integrating web services. The juddi-client package is a client library for accessing jUDDI services. This vulnerability affects versions 3.1.2 to 3.1.5 of the juddi-client package. The vulnerability occurs in the logout JSP page of the jUDDI portal, which is based on the Pluto portlets user interface. Malicious users can exploit this vulnerability to redirect the browser to unintended web pages. Before the redirection, user session data, credentials, and authentication tokens are cleared.
Vulnerability Detail
The Apache jUDDI juddi-client package versions 3.1.2 to 3.1.5 are vulnerable to a moderate severity issue. After logging into the jUDDI portal, the logout JSP page redirects the browser back to the login page. However, malicious users can manipulate the redirection and redirect the browser to an unintended web page. This vulnerability is specific to the jUDDI portal's portlets-based user interface, also known as 'Pluto', 'jUDDI Portal', 'UDDI Portal', or 'uddi-console'. The impact of this vulnerability includes potential unauthorized access to sensitive information and potential phishing attacks. The vulnerability has a CVSS score of 6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
How To Fix
Minimum fixed version
3.2.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to a fixed version is not immediately possible, a temporary workaround can be implemented by modifying the logout JSP page. The redirection logic can be updated to ensure that the browser is redirected only to the intended login page. Here is an example of how the code can be modified:
<%-- Original code --%>
<% response.sendRedirect("login.jsp"); %>
<%-- Modified code --%>
<% response.sendRedirect("/path/to/login.jsp"); %>
Replace "/path/to/login.jsp" with the actual path to the login page in your application.
Conclusion
The Apache jUDDI juddi-client package versions 3.1.2 to 3.1.5 are vulnerable to a logout page redirection issue in the jUDDI portal's portlets-based user interface. This vulnerability can be mitigated by upgrading to version 3.2.0 or later of the juddi-client package. If immediate upgrade is not possible, a temporary workaround can be implemented by modifying the logout JSP page. It is important to address this vulnerability to prevent unauthorized access and potential phishing attacks. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.apache.juddi:juddi-client →
FAQ
Apache jUDDI is an open-source Java implementation of the Universal Description, Discovery, and Integration (UDDI) specification. It provides a platform for publishing, discovering, and integrating web services.
The juddi-client package is a client library for accessing jUDDI services. It allows developers to interact with jUDDI programmatically.
The vulnerability occurs in the logout JSP page of the jUDDI portal's portlets-based user interface. After logging into the portal, the logout page redirects the browser back to the login page. However, malicious users can manipulate the redirection and redirect the browser to unintended web pages.
The vulnerability can lead to unauthorized access to sensitive information and potential phishing attacks. By redirecting the browser to unintended web pages, attackers can trick users into entering their credentials on malicious sites.
The CVSS score of this vulnerability is 6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). This indicates a moderate severity vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.juddi:juddi-client.
