Jasig Updates uPortal To Tackle Potential Exploit

Jasig has released an update to uPortal to address a vulnerability affecting uPortal 4 and dependent software, such as uMobile and SSP.

uPortal is an open source enterprise portal that's built on Java, XML, JSP, and Java 2 Platform Enterprise Edition (J2EE) technologies, providing a framework for building portals with standards-based integration (including authentication and security applications), single login, and customization.

uPortal 4.0.11.1 addresses a vulnerability in uPortal 4.x that could allow other applications to log in as a user. As Jasig described it: "This is an illicit proxy vulnerability wherein other applications using the same CAS server as the portal may be able to themselves access the portal as the end user, and then are able to do anything the end user would have been able to do through the portal. This is not a privilege escalation vulnerability, in that illicit proxies can illicitly proxy only as users who use CAS to log in to them. They cannot arbitrarily become other users or escalate privileges beyond those of the user as whom they're illicitly accessing the portal."

Jasig indicated that the vulnerability is "very likely" to be exploitable but unlikely to have been exploited so far.

The uPortal 4.0.11.1 update is available now. Complete details on the vulnerability can be found in the latest uPortal release notes, along with links to code.

 

About the Author

David Nagel is the former editorial director of 1105 Media's Education Group and editor-in-chief of THE Journal, STEAM Universe, and Spaces4Learning. A 30-year publishing veteran, Nagel has led or contributed to dozens of technology, art, marketing, media, and business publications.

He can be reached at [email protected]. You can also connect with him on LinkedIn at https://www.linkedin.com/in/davidrnagel/ .


Featured

  • student reading a book with a brain, a protective hand, a computer monitor showing education icons, gears, and leaves

    4 Steps to Responsible AI Implementation

    Researchers at the University of Kansas Center for Innovation, Design & Digital Learning (CIDDL) have published a new framework for the responsible implementation of artificial intelligence at all levels of education.

  • glowing digital brain interacts with an open book, with stacks of books beside it

    Federal Court Rules AI Training with Copyrighted Books Fair Use

    A federal judge ruled this week that artificial intelligence company Anthropic did not violate copyright law when it used copyrighted books to train its Claude chatbot without author consent, but ordered the company to face trial on allegations it used pirated versions of the books.

  • server racks, a human head with a microchip, data pipes, cloud storage, and analytical symbols

    OpenAI, Oracle Expand AI Infrastructure Partnership

    OpenAI and Oracle have announced they will develop an additional 4.5 gigawatts of data center capacity, expanding their artificial intelligence infrastructure partnership as part of the Stargate Project, a joint venture among OpenAI, Oracle, and Japan's SoftBank Group that aims to deploy 10 gigawatts of computing capacity over four years.

  • laptop displaying a phishing email icon inside a browser window on the screen

    Phishing Campaign Targets ED Grant Portal

    Threat researchers at cybersecurity company BforeAI have identified a phishing campaign spoofing the U.S. Department of Education's G5 grant management portal.