Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1qN2YyLWNxdnEtNWpjZs4AAe7h

Apache Sling Auth Core bundle vulnerable to Open Redirection

Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core (org.apache.sling.auth.core) bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the resource parameter, related to "a custom login form and XSS."

Permalink: https://github.com/advisories/GHSA-j7f2-cqvq-5jcf
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qN2YyLWNxdnEtNWpjZs4AAe7h
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 2 years ago
Updated: over 1 year ago

CVSS Score: 4.7
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Percentage: 0.00348
EPSS Percentile: 0.72509

Identifiers: GHSA-j7f2-cqvq-5jcf, CVE-2013-4390
References:

• https://nvd.nist.gov/vuln/detail/CVE-2013-4390
• https://issues.apache.org/jira/browse/SLING-3141
• http://mail-archives.apache.org/mod_mbox/sling-dev/201310.mbox/%3CCAKkCf4qdFxEW9NXBJoMsrBama8LFNyir%2B61A0Vfzp4njEpeU%3Dw%40mail.gmail.com%3E
• http://secunia.com/advisories/55249
• http://www.securityfocus.com/bid/63241
• https://github.com/apache/sling-org-apache-sling-auth-core/commit/d1cd9aaa3432d577b65c50b3fbdc36d5d667ca46
• https://github.com/advisories/GHSA-j7f2-cqvq-5jcf

Repository: https://github.com/apache/sling-org-apache-sling-auth-core
Blast Radius: 9.1

Affected Packages