CVE-2017-15700

CWE-200 — Information Exposure4 documents4 sources
Severity
8.8HIGH
EPSS
0.2%
top 54.87%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache SlingApache Sling Authentication Service
Timeline
PublishedDec 18
Latest updateMay 14

Description

A flaw in the org.apache.sling.auth.core.AuthUtil#isRedirectValid method in Apache Sling Authentication Service 1.4.0 allows an attacker, through the Sling login form, to trick a victim to send over their credentials.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5apache_software_foundation/apache_slingAuthentication Service 1.4.0

🔴Vulnerability Details

3
GHSA
Apache Sling Authentication Service vulnerability↗2022-05-14
▶
OSV
Apache Sling Authentication Service vulnerability↗2022-05-14
▶
CVEList
CVE-2017-15700: A flaw in the org↗2017-12-18
▶
CVE-2017-15700 (HIGH CVSS 8.8) | A flaw in the org.apache.sling.auth | cvebase.io