[
https://issues.apache.org/jira/browse/JUDDI-903?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14255323#comment-14255323
]
ASF subversion and git services commented on JUDDI-903:
-------------------------------------------------------
Commit c674214cb109f69b6eeef136da83cf9f3398bf06 in juddi's branch
refs/heads/master from [~spyhunter99]
[ https://git-wip-us.apache.org/repos/asf?p=juddi.git;h=c674214 ]
JUDDI-903 jpa typo
> SQL Injection on JUDDI API service, delete_publisher
> ----------------------------------------------------
>
> Key: JUDDI-903
> URL: https://issues.apache.org/jira/browse/JUDDI-903
> Project: jUDDI
> Issue Type: Bug
> Components: core
> Affects Versions: 3.2, 3.2.1
> Reporter: Alex O'Ree
> Assignee: Alex O'Ree
> Priority: Critical
> Fix For: 3.3
>
>
> There's a potential for SQL injection in the Juddi API service. Due to the
> way the code is constructed, it's possible for a malicious user to be created
> containing a SQL statement as the user name. When an administrator attempts
> to delete the publisher, there's a chance that the malicious username may be
> executed as a SQL statement.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
