{"api_version":"1","generated_at":"2026-07-23T20:30:11+00:00","cve":"CVE-2016-0710","urls":{"html":"https://cve.report/CVE-2016-0710","api":"https://cve.report/api/cve/CVE-2016-0710.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2016-0710","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2016-0710"},"summary":{"title":"CVE-2016-0710","description":"Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the (1) role or (2) user parameter to services/usermanager/users/.","state":"PUBLISHED","assigner":"redhat","published_at":"2016-04-11 14:59:03","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-89","n/a"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"8.8","severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://packetstormsecurity.com/files/136489/Apache-Jetspeed-Arbitrary-File-Upload.html","name":"http://packetstormsecurity.com/files/136489/Apache-Jetspeed-Arbitrary-File-Upload.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Apache Jetspeed Arbitrary File Upload ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://mail-archives.apache.org/mod_mbox/portals-jetspeed-user/201603.mbox/%3C046318A1-226E-453F-9394-B84F1A33E6A4%40bluesunrise.com%3E","name":"https://mail-archives.apache.org/mod_mbox/portals-jetspeed-user/201603.mbox/%3C046318A1-226E-453F-9394-B84F1A33E6A4%40bluesunrise.com%3E","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[CVE-2016-0710] Apache Jetspeed information disclosure vulnerability","mime":"text/xml","httpstatus":"200","archivestatus":"200"},{"url":"http://www.rapid7.com/db/modules/exploit/multi/http/apache_jetspeed_file_upload","name":"http://www.rapid7.com/db/modules/exploit/multi/http/apache_jetspeed_file_upload","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"CVE-2016-0710 Apache Jetspeed Arbitrary File Upload | Rapid7","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.exploit-db.com/exploits/39643/","name":"https://www.exploit-db.com/exploits/39643/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Apache Jetspeed - Arbitrary File Upload (Metasploit) - Java remote Exploit","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-0710","name":"https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-0710","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Jetspeed 2 - Jetspeed Security Reports","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-and","name":"http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-and","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"haxx.ml — Remote Code Execution in Apache Jetspeed 2.3.0 and...","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://mail-archives.apache.org/mod_mbox/portals-jetspeed-user/201603.mbox/%3C046318A1-226E-453F-9394-B84F1A33E6A4@bluesunrise.com%3E","name":"MLIST:[portals-jetspeed-user] 20160303 [CVE-2016-0710] Apache Jetspeed information disclosure vulnerability","refsource":"MITRE","tags":[],"title":"[CVE-2016-0710] Apache Jetspeed information disclosure vulnerability","mime":"text/xml","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-0710","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0710","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2016","cve_id":"710","vulnerable":"1","versionEndIncluding":"2.3.0","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apache","cpe5":"jetspeed","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-05T22:30:03.505Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"39643","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/39643/"},{"name":"[portals-jetspeed-user] 20160303 [CVE-2016-0710] Apache Jetspeed information disclosure vulnerability","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"https://mail-archives.apache.org/mod_mbox/portals-jetspeed-user/201603.mbox/%3C046318A1-226E-453F-9394-B84F1A33E6A4%40bluesunrise.com%3E"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-and"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.rapid7.com/db/modules/exploit/multi/http/apache_jetspeed_file_upload"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.com/files/136489/Apache-Jetspeed-Arbitrary-File-Upload.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-0710"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2016-03-03T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the (1) role or (2) user parameter to services/usermanager/users/."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2016-04-11T13:57:01.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"name":"39643","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/39643/"},{"name":"[portals-jetspeed-user] 20160303 [CVE-2016-0710] Apache Jetspeed information disclosure vulnerability","tags":["mailing-list","x_refsource_MLIST"],"url":"https://mail-archives.apache.org/mod_mbox/portals-jetspeed-user/201603.mbox/%3C046318A1-226E-453F-9394-B84F1A33E6A4%40bluesunrise.com%3E"},{"tags":["x_refsource_MISC"],"url":"http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-and"},{"tags":["x_refsource_MISC"],"url":"http://www.rapid7.com/db/modules/exploit/multi/http/apache_jetspeed_file_upload"},{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.com/files/136489/Apache-Jetspeed-Arbitrary-File-Upload.html"},{"tags":["x_refsource_CONFIRM"],"url":"https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-0710"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"secalert@redhat.com","ID":"CVE-2016-0710","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the (1) role or (2) user parameter to services/usermanager/users/."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"39643","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/39643/"},{"name":"[portals-jetspeed-user] 20160303 [CVE-2016-0710] Apache Jetspeed information disclosure vulnerability","refsource":"MLIST","url":"https://mail-archives.apache.org/mod_mbox/portals-jetspeed-user/201603.mbox/%3C046318A1-226E-453F-9394-B84F1A33E6A4@bluesunrise.com%3E"},{"name":"http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-and","refsource":"MISC","url":"http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-and"},{"name":"http://www.rapid7.com/db/modules/exploit/multi/http/apache_jetspeed_file_upload","refsource":"MISC","url":"http://www.rapid7.com/db/modules/exploit/multi/http/apache_jetspeed_file_upload"},{"name":"http://packetstormsecurity.com/files/136489/Apache-Jetspeed-Arbitrary-File-Upload.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/136489/Apache-Jetspeed-Arbitrary-File-Upload.html"},{"name":"https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-0710","refsource":"CONFIRM","url":"https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-0710"}]}}}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2016-0710","datePublished":"2016-04-11T14:00:00.000Z","dateReserved":"2015-12-16T00:00:00.000Z","dateUpdated":"2024-08-05T22:30:03.505Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2016-04-11 14:59:03","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-89","n/a"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:jetspeed:*:*:*:*:*:*:*:*","versionEndIncluding":"2.3.0","matchCriteriaId":"3B7DAFB8-85FD-462F-A9A3-AD76C62557F7"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2016","CveId":"710","Ordinal":"1","Title":"CVE-2016-0710","CVE":"CVE-2016-0710","Year":"2016"},"notes":[{"CveYear":"2016","CveId":"710","Ordinal":"1","NoteData":"Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the (1) role or (2) user parameter to services/usermanager/users/.","Type":"Description","Title":"CVE-2016-0710"},{"CveYear":"2016","CveId":"710","Ordinal":"2","NoteData":"2016-04-11","Type":"Other","Title":"Published"},{"CveYear":"2016","CveId":"710","Ordinal":"3","NoteData":"2016-04-11","Type":"Other","Title":"Modified"}]}}}