Alex O'Ree created JUDDI-903:
--------------------------------
Summary: SQL Injection on JUDDI API service, delete_publisher
Key: JUDDI-903
URL: https://issues.apache.org/jira/browse/JUDDI-903
Project: jUDDI
Issue Type: Bug
Components: core
Affects Versions: 3.2.1, 3.2
Reporter: Alex O'Ree
Assignee: Alex O'Ree
Priority: Critical
Fix For: 3.3
There's a potential for SQL injection in the Juddi API service. Due to the way
the code is constructed, it's possible for a malicious user to be created
containing a SQL statement as the user name. When an administrator attempts to
delete the publisher, there's a chance that the malicious username may be
executed as a SQL statement.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
