[ https://issues.apache.org/jira/browse/JUDDI-903?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14255323#comment-14255323 ]
ASF subversion and git services commented on JUDDI-903: ------------------------------------------------------- Commit c674214cb109f69b6eeef136da83cf9f3398bf06 in juddi's branch refs/heads/master from [~spyhunter99] [ https://git-wip-us.apache.org/repos/asf?p=juddi.git;h=c674214 ] JUDDI-903 jpa typo > SQL Injection on JUDDI API service, delete_publisher > ---------------------------------------------------- > > Key: JUDDI-903 > URL: https://issues.apache.org/jira/browse/JUDDI-903 > Project: jUDDI > Issue Type: Bug > Components: core > Affects Versions: 3.2, 3.2.1 > Reporter: Alex O'Ree > Assignee: Alex O'Ree > Priority: Critical > Fix For: 3.3 > > > There's a potential for SQL injection in the Juddi API service. Due to the > way the code is constructed, it's possible for a malicious user to be created > containing a SQL statement as the user name. When an administrator attempts > to delete the publisher, there's a chance that the malicious username may be > executed as a SQL statement. -- This message was sent by Atlassian JIRA (v6.3.4#6332)