CVE-2014-3416: uPortal before 4.0.13.1 does not properly check the MANAGE permissions, which allows remote authenticated u...

Security readout for executives and security teams

CVE-2014-3416 is an access-control flaw in uPortal before 4.0.13.1. An authenticated user with SUBSCRIBE access to the portlet-admin portlet could manage portlets they should not control. Business risk is unauthorized portal configuration changes, not unauthenticated takeover based on the supplied sources. Exposure is limited to deployments of uPortal earlier than 4.0.13.1. Risk is higher where many authenticated users or broad roles have SUBSCRIBE permission for the portlet-admin portlet. Prioritize remediation if uPortal is internet-accessible, broadly used internally, or permits many authenticated users. The issue is not known exploited from supplied sources, but it can undermine portal integrity and administrative control. Mitigation focus: Upgrade uPortal to 4.0.13.1 or a later supported release.; Review vendor guidance from the Jasig issue and release references.; Restrict access to the portlet-admin portlet to trusted administrative roles..

Prepared

Jun 14, 2026, 14:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.