GHSA-j7f2-cqvq-5jcf

Source

https://github.com/advisories/GHSA-j7f2-cqvq-5jcf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-j7f2-cqvq-5jcf/GHSA-j7f2-cqvq-5jcf.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-j7f2-cqvq-5jcf

Aliases

CVE-2013-4390

Published

2022-05-17T04:59:24Z

Modified

2024-02-16T08:08:24.792458Z

Severity

4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Apache Sling Auth Core bundle vulnerable to Open Redirection

Details

Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core (org.apache.sling.auth.core) bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the resource parameter, related to "a custom login form and XSS."

Database specific

{
    "nvd_published_at": "2013-10-24T03:48:00Z",
    "github_reviewed_at": "2023-08-29T19:02:49Z",
    "cwe_ids": [
        "CWE-601"
    ],
    "github_reviewed": true,
    "severity": "MODERATE"
}

References

Affected packages

Maven / org.apache.sling:org.apache.sling.auth.core

Package

Name: org.apache.sling:org.apache.sling.auth.core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.sling/org.apache.sling.auth.core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.1.4

Affected versions

1.*

1.0.0

1.0.2

1.0.4

1.0.6

1.1.0

1.1.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-j7f2-cqvq-5jcf/GHSA-j7f2-cqvq-5jcf.json"