apache org.apache.sling.servlets.post vulnerabilities

Latest apache org.apache.sling.servlets.post CVEs

Newest publication first

1. CVE-2013-2254 Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Sling

   Published 2013-10-17

   Medium·CVSS 5.0 EPSS 4.1%

   The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in Apache Sling does not properly handle a NULL value that returned when the session does not have permissions to the root node, which allows...

2. CVE-2012-2138 Apache Sling POST Servlets Denial of Service Vulnerability

   Published 2012-07-09

   Medium·CVSS 5.0 EPSS 14.1%

   The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service (infinite loop) via a crafted...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.