CVE-2017-15700
HIGHApache Sling Authentication Service 1.4.0 - Exposure of Sensitive Information via Login Form Redirect
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2017-15700. PoCs published by dawetmaster, andikahilmy.
AI-analyzed exploit summary The repository contains a technical analysis of CVE-2017-15700, focusing on vulnerable Java files in the Apache Sling authentication core. It includes source code for authentication utilities and servlets, with a README guiding the analysis of specific test files and methods.
Description
A flaw in the org.apache.sling.auth.core.AuthUtil#isRedirectValid method in Apache Sling Authentication Service 1.4.0 allows an attacker, through the Sling login form, to trick a victim to send over their credentials.
Exploits (2)
The repository contains a technical analysis of CVE-2017-15700, focusing on vulnerable Java files in the Apache Sling authentication core. It includes source code for authentication utilities and servlets, with a README guiding the analysis of specific test files and methods.
This repository contains the vulnerable source code of Apache Sling Auth Core (CVE-2017-15700), which is an authentication bypass vulnerability. The code includes core authentication classes and utilities, but no exploit PoC or technical analysis is provided.
References (1)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H