CVE-2017-15700 Apache Sling Authentication Service vulnerability
HighCVSS 8.8
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A flaw in the org.apache.sling.auth.core.AuthUtil#isRedirectValid method in Apache Sling Authentication Service 1.4.0 allows an attacker, through the Sling login form, to trick a victim to send over their credentials.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.sling/org.apache.sling.auth.core(Maven) | >= 1.4.0, < 1.4.2 | 1.4.2 |
| org.apache.sling/org.apache.sling.auth.core(Maven) | = 1.4.0 | No fix listed |
| apache sling authentication service | = 1.4.0 | No fix listed |
| Apache Sling | = Authentication Service 1.4.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com product
- lists.apache.org
- github.com
- [dev] 20171218 CVE-2017-15700 - Apache Sling Authentication Service vulnerability mailing-list