CVE-2012-2138 Apache Sling POST Servlets Denial of Service Vulnerability
MediumCVSS 5.0
EPSS 14.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.sling/org.apache.sling.servlets.post(Maven) | < 2.1.2 | 2.1.2 |
| org.apache.sling/org.apache.sling.servlets.post(Maven) | = 2.0.2-incubator | No fix listed |
| org.apache.sling/org.apache.sling.servlets.post(Maven) | = 2.0.4-incubator | No fix listed |
| org.apache.sling/org.apache.sling.servlets.post(Maven) | = 2.1.0 | No fix listed |
| apache org.apache.sling.servlets.post | <= 2.1.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- issues.apache.org
- mail-archives.apache.org
- svn.apache.org
- github.com patch
- github.com
- [www-announce] 20120706 [SECURITY] CVE-2012-2138 Apache Sling denial of service vulnerability mailing-list