23 May 2014
uPortal 4.0.13.1 Announcement
Apereo has released uPortal 4.0.13.1, which is uPortal 4.0.13 with security fixes to properly enforce MANAGE and CONFIG permissions.
Prior to this release, portlet administration permissions are bugged such that
...
Security Bug
- [UP-4105] - CVE-2014-3146 3416 MANAGE[-*] permissions not enforced
- [UP-4106] - CVE-2014-3147 3417 Any user can Configure any portlet they can SUBSCRIBE
...
Issues addressed in uPortal 4.0.13.1
Jira Legacy | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|
|
Bugs known to afflict uPortal 4.0.13.1
(Note that this listing is only as good as JIRA issue metadata about affects-version.)
Jira Legacy | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|
|