CVEvulnerability

CVE-2013-4390

5.8 MEDIUM Published 2013-10-24 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2013-10-24
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
5.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:N
Weaknesses
CWE-20

Description

Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core (org.apache.sling.auth.core) bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the resource parameter, related to "a custom login form and XSS."

Affected configurations

• apache sling • apache sling auth core component (<= 1.1.2) • apache sling auth core component 1.0.2 • apache sling auth core component 1.0.4 • apache sling auth core component 1.0.6 • apache sling auth core component 1.1.0

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References