Privilege Escalation

org.apache.sling:org.apache.sling.engine is vulnerable to Privilege Escalation. When an attacker is able to include a resource with specific content-type and control the include path, it allows the attacker to elevate privileges and acquire administrative power, because SlingRequestDispatcher doesn’t correctly implement the RequestDispatcher API.