Threats tagged 'ghsa-g82c-vmxh-2c3f'

Apache Roller versions 4.0 through 6.1.6 have a vulnerability where an unauthenticated visitor can read blog entries that authors have withdrawn to draft status via the AtomPub API. Although the entry is removed from the weblog, it remains in the search index and is visible through public search. AtomPub is disabled by default. Upgrading to version 6.1.7 or later resolves this issue by ensuring only published entries appear in search results.