Unscored severity · published Oct 24, 2013
CVE-2013-4390
Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core (org.apache.sling.auth.core) bundle before 1.1.4 in Apache Sling allows remote attackers to…
–
CVSS
3.1%
EPSS
No
On KEV
Description
Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core (org.apache.sling.auth.core) bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the resource parameter, related to "a custom login form and XSS."
Exploitation
Is it being used?
Exploit prediction (EPSS)3.1% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SL
Sling · Apache
All versions, or not specified · source: NVD
SA
Sling Auth Core Component · Apache
through 1.1.2; 1.0.2; 1.0.4; 1.0.6; 1.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-4390
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-4390
Vendor Advisory
http://mail-archives.apache.org/mod_mbox/sling-dev/201310.mbox/%3CCAKkCf4qdFxEW9NXBJoMsrBama8LFNyir%2B61A0Vfzp4njEpeU%3Dw%40mail.gmail.com%3E
Vendor Advisory
http://secunia.com/advisories/55249
www.securityfocus.com
http://www.securityfocus.com/bid/63241
issues.apache.org
https://issues.apache.org/jira/browse/SLING-3141
More from Sling
9.8
CVE-2016-6798
In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the input string, which allows for XXE attacks…
7.5
CVE-2016-0956
The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to obtain sensitive information via…
6.1
CVE-2016-5394
In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns…