CVE-2014-3417
uPortal before 4.0.13.1 does not properly check the CONFIG permission, which allows remote authenticated users to configure portlets by leveraging the SUBSCRIBE permission for a portlet.
- EPSS
- 1.1% chance of exploitation in the next 30 days; higher than 64% of CVEs (scores of 2026-10-31)
- CWE
- CWE-264
- Published
- Modified
- Record from
- the NVD, synced
Affected
- jasig:uportal