PT-2017-14149 · Apache · Apache Sling Authentication Service

Publicado 2017-12-18 · Atualizado 2022-05-14 · CVE-2017-15700

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Sling Authentication Service version 1.4.0

Description A flaw in the org.apache.sling.auth.core.AuthUtil#isRedirectValid method allows an attacker to trick a victim into sending over their credentials through the Sling login form.

Recommendations For Apache Sling Authentication Service version 1.4.0, consider disabling the org.apache.sling.auth.core.AuthUtil#isRedirectValid method until a patch is available. Restrict access to the Sling login form to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-15700

GHSA-VCVP-89FQ-HWJ8

Produtos afetados

Apache Sling Authentication Service

Referências · 6

• https://github.com/apache/sling-org-apache-sling-auth-core · Nota
• https://osv.dev/vulnerability/GHSA-vcvp-89fq-hwj8 · Aviso do Fabricante
• https://lists.apache.org/thread.html/182bed1dd6933824a81cc5f07639eeb813fbd8f2cc49d51b452ab621@%3Cdev.sling.apache.org%3E · Nota
• https://osv.dev/vulnerability/CVE-2017-15700 · Aviso do Fabricante
• https://lists.apache.org/thread.html/182bed1dd6933824a81cc5f07639eeb813fbd8f2cc49d51b452ab621%40%3Cdev.sling.apache.org%3E · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-15700 · Nota de Segurança