CVE-2017-15700 is a high-severity vulnerability affecting Apache Sling Authentication Service 1.4.0, specifically within the org.apache.sling.auth.core.AuthUtil#isRedirectValid method. This flaw allows an attacker to trick users into submitting their credentials via the Sling login form, leading to potential compromise of sensitive information. With a CVSS score of 8.8 (HIGH), it presents a significant risk due to its network-based attack vector and high impact on confidentiality, integrity, and availability. While no active exploitation, public exploit code, or significant community discussion has been observed, organizations using the affected product should prioritize patching.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.4.0CPE matchmatch criteria | cpe:2.3:a:apache:sling_authentication_service:1.4.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.