Exposure of Sensitive Information to an Unauthorized Actor in Apache Sling Servlets Post

Description

References

• nvd.nist.gov/vuln/detail/CVE-2016-0956 · ADVISORY
• helpx.adobe.com/security/products/experience-manager/apsb16-05.html · WEB
• exploit-db.com/exploits/39435 · WEB
• packetstormsecurity.com/files/135720/Apache-Sling-Framework-2.3.6-Information-Disclosure.html · WEB
• seclists.org/fulldisclosure/2016/Feb/48 · WEB
• securityfocus.com/archive/1/537498/100/0/threaded · WEB
• exploit-db.com/exploits/39435

Autres vulnérabilités de org.apache.sling:org.apache.sling.servlets.post

• CVE-2017-9802MOYENNE 6.1The Javascript method Sling.evalString() in Apache Sling Servlets Post before 2.3.22 uses the javascript 'eval' function to parse input stri…
• CVE-2015-2944MOYENNE 4.3Multiple cross-site scripting (XSS) vulnerabilities in Apache Sling API before 2.2.2 and Apache Sling Servlets Post before 2.1.2 allow remot…
• CVE-2012-2138MOYENNE 5.0The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attem…