What is GHSA-vcvp-89fq-hwj8?

GHSA-vcvp-89fq-hwj8 is a security advisory published by GitHub Security Advisories with High severity. Apache Sling Authentication Service vulnerability

Which CVE IDs does GHSA-vcvp-89fq-hwj8 cover?

GHSA-vcvp-89fq-hwj8 covers the following CVE IDs: CVE-2017-15700. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vcvp-89fq-hwj8?

GHSA-vcvp-89fq-hwj8 has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-vcvp-89fq-hwj8?

GHSA-vcvp-89fq-hwj8 affects 1 product, including: maven/org.apache.sling:org.apache.sling.auth.core:\u003e= 1.4.0, \u003c 1.4.2.

GHSA-vcvp-89fq-hwj8HighCVSS 8.8

Apache Sling Authentication Service vulnerability

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

August 9, 2024

🔗 CVE IDs covered (1)

CVE-2017-15700 →

📋 Description

A flaw in the org.apache.sling.auth.core.AuthUtil#isRedirectValid method in Apache Sling Authentication Service 1.4.0 allows an attacker, through the Sling login form, to trick a victim to send over their credentials.

🎯 Affected products1

maven/org.apache.sling:org.apache.sling.auth.core:>= 1.4.0, < 1.4.2

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2017-15700
https://lists.apache.org/thread.html/182bed1dd6933824a81cc5f07639eeb813fbd8f2cc49d51b452ab621@%3Cdev.sling.apache.org%3E
https://github.com/advisories/GHSA-vcvp-89fq-hwj8