CVE-2013-4390 Apache Sling Auth Core bundle vulnerable to Open Redirection
Remote attackers can redirect users to malicious sites via the resource parameter in Apache Sling's authentication form, facilitating phishing attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2013-4390?
CVE-2013-4390 is a medium-severity vulnerability in n/a, published on 24 Oct 2013. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core (org.apache.sling.auth.core) bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the resource parameter, related to "a custom login form and XSS."
Weakness: CWE-20
Which versions are affected by CVE-2013-4390?
2 open source packages ship an affected version, including org.apache.sling:org.apache.sling.auth.core. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.sling:org.apache.sling.auth.core Maven | All versions | 1.1.4 |
org.apache.sling:org.apache.sling.auth.core Maven | All versions | 1.1.4 |
Products include Apache Sling, Apache Sling Auth Core Component.
How do I fix CVE-2013-4390?
Upgrade org.apache.sling:org.apache.sling.auth.core to 1.1.4 or later.
Is CVE-2013-4390 being exploited?
There is no known exploitation of CVE-2013-4390 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-j7f2-cqvq-5jcf.