GitHub Advisoryadvisory · Maven

GHSA-342c-f869-5m44 Apache Sling POST Servlets Denial of Service Vulnerability

MEDIUM Published 2022-05-17 Modified 2023-08-29 Official page ↗
Aliases
CVE-2012-2138
Ecosystem
Maven
Packages
org.apache.sling:org.apache.sling.servlets.post
Severity
Moderate
Weaknesses
CWE-400
Reviewed
2023-08-29

Affected packages

• Maven org.apache.sling:org.apache.sling.servlets.post: < 2.1.2 → fixed in 2.1.2

Description

The `@CopyFrom` operation in the POST servlet in the `org.apache.sling.servlets.post` bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP request.

Related

Alias · CVE (1)

  • CVE-2012-2138 The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References