Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.7

Apache Sling: Phishing Attack via Fake Login Page

CVE-2013-4390 · published 13 years ago
Summary

A security issue in Apache Sling's login system allows an attacker to trick users into visiting a fake login page that might look like a real one. This could be used to steal a user's login credentials. To fix this, update to Apache Sling version 1.1.4 or later.

What to do
  • Update apache org.apache.sling:org.apache.sling.auth.core to version 1.1.4.
Affected software
Ecosystem VendorProductAffected versions
maven apache org.apache.sling:org.apache.sling.auth.core < 1.1.4
Fix: upgrade to 1.1.4
– apache sling All versions
cpe:2.3:a:apache:sling:*:*:*:*:*:*:*:*
– apache sling_auth_core_component <= 1.1.2
1.0.2
1.0.4
1.0.6
1.1.0
cpe:2.3:a:apache:sling_auth_core_component:*:*:*:*:*:*:*:*
Original advisory text
Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core (org.apache.sling.auth.core) bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to a...
Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core (org.apache.sling.auth.core) bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the resource parameter, related to "a custom login form and XSS."
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.7 Medium
Exploitation
3% chance of attack within 30 days
Type
CWE-601Open Redirect
CWE-20Improper Input Validation
Timeline
Published24 Oct 2013
Updated31 Oct 2026
First seen6 Mar 2026
Sources
GHSA-j7f2-cqvq-5jcf · GHSA
CVE-2013-4390 · NVD
Track software like this
Free during beta