CVE-2017-15700
CVE-2017-15700
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 1.9%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
18 Dec 2017Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
A flaw in the org.apache.sling.auth.core.AuthUtil#isRedirectValid method in Apache Sling Authentication Service 1.4.0 allows an attacker, through the Sling login form, to trick a victim to send over their credentials.
Affected products
Apache Software Foundation · Apache SlingWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →