PT-2017-6442
CVE-2015-0249
·
Published
2017-07-14
·
Updated
2017-07-27
Description by
CVSS 2.0
6.5
MediumMetricsAV:N/AC:L/Au:S/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions
Apache Roller versions 5.1 through 5.1.1
Description
The issue allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language (VTL) in the weblog page template.
Recommendations
For Apache Roller versions 5.1 through 5.1.1, consider restricting access to the weblog page template to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the use of Velocity Text Language (VTL) in the weblog page template to prevent the execution of arbitrary Java code.
Found an issue in the description? Have something to add? Feel free to write us 👾