CVE-2013-4390
Apache Sling Auth Core < 1.1.4 - Open Redirect via Resource Parameter
Title source: llmDescription
Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core (org.apache.sling.auth.core) bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the resource parameter, related to "a custom login form and XSS."
References (4)
Core 4
Core References
Various Sources x_refsource_confirm
https://issues.apache.org/jira/browse/SLING-3141
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/63241
Vendor Advisory mailing-list
x_refsource_mlist
http://mail-archives.apache.org/mod_mbox/sling-dev/201310.mbox/%3CCAKkCf4qdFxEW9NXBJoMsrBama8LFNyir%2B61A0Vfzp4njEpeU%3Dw%40mail.gmail.com%3E
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/55249
Scores
EPSS
0.0306
EPSS Percentile
86.0%
Details
CWE
CWE-20
Status
published
Products (7)
apache/sling
apache/sling_auth_core_component
1.0.2
apache/sling_auth_core_component
1.0.4
apache/sling_auth_core_component
1.0.6
apache/sling_auth_core_component
1.1.0
apache/sling_auth_core_component
< 1.1.2
org.apache.sling/org.apache.sling.auth.core
0 - 1.1.4Maven
Published
Oct 24, 2013
Tracked Since
Feb 18, 2026