CVE-2017-15700

A flaw in the org.apache.sling.auth.core.AuthUtil#isRedirectValid method in Apache Sling Authentication Service 1.4.0 allows an attacker, through the Sling login form, to trick a victim to send over their credentials.

Score

CVSS 3.0 8.8 High

Status

Modified - security@apache.org

Published

2017-12-18

Last modified

2024-09-17

Weaknesses

CWE-200

Affected products

• Sling Authentication Service (Apache)
• Apache Sling (Apache Software Foundation)

References

• https://lists.apache.org/thread.html/182bed1dd6933824a81cc5f07639eeb813fbd8f2cc49d51b452ab621%40%3Cdev.sling.apache.org…