juddi-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Alex O'Ree" <alexo...@apache.org>
Subject jUDDI Security Bulletin
Date Thu, 18 May 2017 23:27:58 GMT
[VERSION]: 3.1.2, 3.1.3, 3.1.4, and 3.1.5 utilize the portlets based
user interface also known as 'Pluto', 'jUDDI Portal', 'UDDI Portal' or

[PROBLEMTYPE]:Open Redirect

[DESCRIPTION]: After logging into the portal, the logout jsp page
redirects the browser back to the login page after. It is feasible for
malicious user to redirect the browser to an unintended web page. User
session data, credentials, and auth tokens are cleared before the


1) Remove or disable the portlet's based user interface.

2) Upgrade to newer versions of jUDDI (v3.2 and newer) which is not
affected by this issue

3) If upgrading or disabling the portlet based user interface is not
an option, the following can be used to resolve the issue. Modify the
file located at "uddi-portlets/logout.jsp", replacing the following

> "String redirectURL = (String) request.getParameter("urlredirect");
> if (redirectURL==null) redirectURL = "/pluto/Logout";

with this text
> String redirectURL = "/pluto/Logout";

No patches or releases are planned for the affected versions since
jUDDI v3.2 replaced the user interface.

View raw message