PT-2012-3830 · Apache · Apache Sling
Bertrand Delacretaz
·
Publicado
2012-07-09
·
Atualizado
2022-05-17
·
CVE-2012-2138
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
Apache Sling versions prior to 2.1.2
Description
The issue allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP request. This is due to the
@CopyFrom operation in the POST servlet not preventing attempts to copy an ancestor node to a descendant node.Recommendations
For versions prior to 2.1.2, update to version 2.1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the POST servlet to minimize the risk of exploitation.
Exploit
Correção
Resource Exhaustion
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Apache Sling