CVE-2013-4390

2022-10-0316:14:58

CWE-20

[email protected]

web.nvd.nist.gov

cve

2013

4390

open redirect

abstractauthenticationformservlet

auth core

apache sling

remote attackers

phishing attacks

xss

nvd

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

6.8 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

54.2%

JSON

Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core (org.apache.sling.auth.core) bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the resource parameter, related to “a custom login form and XSS.”

Affected configurations

NVD

Node

apachesling

apachesling_auth_core_componentRange≤1.1.2

apachesling_auth_core_componentMatch1.0.2

apachesling_auth_core_componentMatch1.0.4

apachesling_auth_core_componentMatch1.0.6

apachesling_auth_core_componentMatch1.1.0

CPENameOperatorVersion
apache:slingapache slingeq*
apache:sling_auth_core_componentapache sling auth core componentle1.1.2
apache:sling_auth_core_componentapache sling auth core componenteq1.0.2
apache:sling_auth_core_componentapache sling auth core componenteq1.0.4
apache:sling_auth_core_componentapache sling auth core componenteq1.0.6
apache:sling_auth_core_componentapache sling auth core componenteq1.1.0

CPE	Name	Operator	Version
apache:sling	apache sling	eq	*
apache:sling_auth_core_component	apache sling auth core component	le	1.1.2
apache:sling_auth_core_component	apache sling auth core component	eq	1.0.2
apache:sling_auth_core_component	apache sling auth core component	eq	1.0.4
apache:sling_auth_core_component	apache sling auth core component	eq	1.0.6
apache:sling_auth_core_component	apache sling auth core component	eq	1.1.0