Skip to content

Product

org.apache.sling/org.apache.sling.auth.core vulnerabilities

2 published CVES affecting org.apache.sling/org.apache.sling.auth.core, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
1
Medium
1
Low
0
Unscored
0
CISA KEV
0

Latest org.apache.sling/org.apache.sling.auth.core CVEs

Newest publication first

  1. CVE-2017-15700 Apache Sling Authentication Service vulnerability

    Published
    HighCVSS 8.8 EPSS 1.9%

    A flaw in the org.apache.sling.auth.core.AuthUtil#isRedirectValid method in Apache Sling Authentication Service 1.4.0 allows an attacker, through the Sling login form, to trick a victim to send over their credentials.

  2. CVE-2013-4390 Apache Sling Auth Core bundle vulnerable to Open Redirection

    Published
    MediumCVSS 5.8 EPSS 3.1%

    Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core (org.apache.sling.auth.core) bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the resource parameter...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.