Ivan Iushkevich

**Name of the Vulnerable Software and Affected Versions** Apache Roller version 6.1.5 **Description** An authorization bypass exists that allows an authenticated user with authoring rights on one weblog to read, modify, or delete resources belonging to another weblog. This occurs through unscoped identifier-based lookups in multi-user installations where users should be isolated. Additionally, a user with administrator rights on their own weblog can overwrite the Velocity template of another weblog, which is then evaluated when the victim weblog renders. Velocity is a Java-based template engine used to generate dynamic content. **Recommendations** Upgrade Apache Roller to version 6.1.6 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Roller version 6.1.5 **Description** An authenticated user can read, modify, or delete weblog content belonging to other weblogs. This occurs because the handlers for the legacy XML-RPC Blogger and MetaWeblog APIs authenticate the caller but fail to verify if the caller has the necessary permissions for the specific weblog or entry being accessed. This issue only affects installations where the non-default global XML-RPC setting is enabled. **Recommendations** Upgrade to Apache Roller version 6.1.6 or later. Disable the XML-RPC feature.

**Name of the Vulnerable Software and Affected Versions** Apache Roller version 6.1.5 **Description** Improper neutralization of input allows an anonymous remote attacker to store a crafted comment-author URL. This can lead to the execution of scripts within the session of a weblog moderator or global administrator when the comment management page is viewed. This issue affects sites that permit comments on at least one weblog and where a moderator reviews the submitted comment, requiring no non-default server settings. **Recommendations** Upgrade Apache Roller to version 6.1.6 or later.