Опубликовано: 14 мая 2022
Источник: github
Github: Прошло ревью
CVSS4: 8.7
CVSS3: 8.8
Описание
Apache Sling Authentication Service vulnerability
A flaw in the org.apache.sling.auth.core.AuthUtil#isRedirectValid method in Apache Sling Authentication Service 1.4.0 allows an attacker, through the Sling login form, to trick a victim to send over their credentials.
Пакеты
Наименование
org.apache.sling:org.apache.sling.auth.core
maven
Затронутые версииВерсия исправления
>= 1.4.0, < 1.4.2
1.4.2
Связанные уязвимости
CVSS3: 8.8
nvd
около 8 лет назад
A flaw in the org.apache.sling.auth.core.AuthUtil#isRedirectValid method in Apache Sling Authentication Service 1.4.0 allows an attacker, through the Sling login form, to trick a victim to send over their credentials.