Description
There's a potential for SQL injection in the Juddi API service. Due to the way the code is constructed, it's possible for a malicious user to be created containing a SQL statement as the user name. When an administrator attempts to delete the publisher, there's a chance that the malicious username may be executed as a SQL statement.
Attachments
Issue Links
- relates to
-
JUDDI-762 deleting a publisher should also delete their content, auth tokens
-
- Closed
-